Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-05-2023 20:26
Static task
static1
Behavioral task
behavioral1
Sample
0882984723094e8cde4a80b44c02efb859d25d2b0ebfd456adc429584bb11ea0.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0882984723094e8cde4a80b44c02efb859d25d2b0ebfd456adc429584bb11ea0.dll
Resource
win10v2004-20230220-en
General
-
Target
0882984723094e8cde4a80b44c02efb859d25d2b0ebfd456adc429584bb11ea0.dll
-
Size
1.7MB
-
MD5
848fa610fb2635e5260a2391331eb29d
-
SHA1
2597ac337005be86228d3fa8423cb80829edf1e8
-
SHA256
0882984723094e8cde4a80b44c02efb859d25d2b0ebfd456adc429584bb11ea0
-
SHA512
3e08fdc5ab448aa48e4d289952830d50de5d429e4e46cff68c3276a509bda4bc7471c9c49a167486672e755da90c948c8c4025d140a1dab0fe43126c88ebeaae
-
SSDEEP
49152:meHXCXE9+5ZbdLqQ9Tbx05mnMhGwatVVhDuiq:meS0Yjb1Vt+qMhGwaphDu
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1076-54-0x0000000010000000-0x000000001051F000-memory.dmp family_blackmoon -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 1076 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 1076 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1376 wrote to memory of 1076 1376 rundll32.exe rundll32.exe PID 1376 wrote to memory of 1076 1376 rundll32.exe rundll32.exe PID 1376 wrote to memory of 1076 1376 rundll32.exe rundll32.exe PID 1376 wrote to memory of 1076 1376 rundll32.exe rundll32.exe PID 1376 wrote to memory of 1076 1376 rundll32.exe rundll32.exe PID 1376 wrote to memory of 1076 1376 rundll32.exe rundll32.exe PID 1376 wrote to memory of 1076 1376 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0882984723094e8cde4a80b44c02efb859d25d2b0ebfd456adc429584bb11ea0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0882984723094e8cde4a80b44c02efb859d25d2b0ebfd456adc429584bb11ea0.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of SetWindowsHookEx