Analysis
-
max time kernel
32s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-06-2023 19:31
Behavioral task
behavioral1
Sample
cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe
Resource
win7-20230220-en
General
-
Target
cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe
-
Size
284KB
-
MD5
bf76d38a92d92b208c60c8a4004110c3
-
SHA1
ccefd7aa5fcafc7dfb6d20e43b3640ab24871d2f
-
SHA256
cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1
-
SHA512
9d360af90ea08351e84bbecd133f842688f75262376aab2fdadf7a0f8c34a0ab771cbfd1c6389a718714cba19d4c6f5f29d67e50acb0f9cdf4990d5a3f9e984b
-
SSDEEP
3072:DGkl+FzE+m817lZ5U3VGSbWsSKXRu/+LjrEtECyqewTvDyRxeUB2JpC:DGkl+Fo87ljwVGSb9pL1Ctpy32Jp
Malware Config
Signatures
-
Detect Blackmoon payload 11 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\uvdAXaPP.exe family_blackmoon C:\Windows\SysWOW64\uvdAXaPP.exe family_blackmoon C:\Windows\SysWOW64\uvdAXaPP.exe family_blackmoon C:\Windows\SysWOW64\uvdAXaPP.exe family_blackmoon C:\Windows\SysWOW64\uvdAXaPP.exe family_blackmoon behavioral1/memory/2004-63-0x0000000000400000-0x000000000045A200-memory.dmp family_blackmoon behavioral1/memory/1324-61-0x0000000000400000-0x000000000045A200-memory.dmp family_blackmoon behavioral1/memory/1180-65-0x0000000000400000-0x000000000045A200-memory.dmp family_blackmoon behavioral1/memory/984-66-0x0000000000400000-0x000000000045A200-memory.dmp family_blackmoon C:\Windows\SysWOW64\uvdAXaPP.exe family_blackmoon behavioral1/memory/984-101-0x0000000000400000-0x000000000045A200-memory.dmp family_blackmoon -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1988 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
uvdAXaPP.exeuvdAXaPP.exeuvdAXaPP.exepid process 1180 uvdAXaPP.exe 2004 uvdAXaPP.exe 984 uvdAXaPP.exe -
Loads dropped DLL 1 IoCs
Processes:
cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exepid process 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe -
Processes:
resource yara_rule behavioral1/memory/984-67-0x00000000002D0000-0x00000000002DB000-memory.dmp upx behavioral1/memory/984-68-0x00000000002D0000-0x00000000002DB000-memory.dmp upx behavioral1/memory/984-69-0x0000000000590000-0x000000000059B000-memory.dmp upx behavioral1/memory/984-94-0x0000000000590000-0x000000000059B000-memory.dmp upx behavioral1/memory/984-103-0x00000000002D0000-0x00000000002DB000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exedescription ioc process File created C:\Windows\SysWOW64\uvdAXaPP.exe cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe File opened for modification C:\Windows\SysWOW64\uvdAXaPP.exe cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
uvdAXaPP.exepid process 984 uvdAXaPP.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exeuvdAXaPP.exedescription pid process Token: SeIncBasePriorityPrivilege 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe Token: SeDebugPrivilege 984 uvdAXaPP.exe Token: SeDebugPrivilege 984 uvdAXaPP.exe Token: SeDebugPrivilege 984 uvdAXaPP.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exeuvdAXaPP.exeuvdAXaPP.exeuvdAXaPP.exepid process 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe 1180 uvdAXaPP.exe 2004 uvdAXaPP.exe 984 uvdAXaPP.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exeuvdAXaPP.exedescription pid process target process PID 1324 wrote to memory of 1180 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe uvdAXaPP.exe PID 1324 wrote to memory of 1180 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe uvdAXaPP.exe PID 1324 wrote to memory of 1180 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe uvdAXaPP.exe PID 1324 wrote to memory of 1180 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe uvdAXaPP.exe PID 1324 wrote to memory of 1988 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe cmd.exe PID 1324 wrote to memory of 1988 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe cmd.exe PID 1324 wrote to memory of 1988 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe cmd.exe PID 1324 wrote to memory of 1988 1324 cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe cmd.exe PID 2004 wrote to memory of 984 2004 uvdAXaPP.exe uvdAXaPP.exe PID 2004 wrote to memory of 984 2004 uvdAXaPP.exe uvdAXaPP.exe PID 2004 wrote to memory of 984 2004 uvdAXaPP.exe uvdAXaPP.exe PID 2004 wrote to memory of 984 2004 uvdAXaPP.exe uvdAXaPP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe"C:\Users\Admin\AppData\Local\Temp\cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uvdAXaPP.exe"C:\Windows\system32\uvdAXaPP.exe" -auto2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CB8281~1.EXE > nul2⤵
- Deletes itself
-
C:\Windows\SysWOW64\uvdAXaPP.exeC:\Windows\SysWOW64\uvdAXaPP.exe Service 11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uvdAXaPP.exe-ojbk2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\uvdAXaPP.exeFilesize
284KB
MD5bf76d38a92d92b208c60c8a4004110c3
SHA1ccefd7aa5fcafc7dfb6d20e43b3640ab24871d2f
SHA256cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1
SHA5129d360af90ea08351e84bbecd133f842688f75262376aab2fdadf7a0f8c34a0ab771cbfd1c6389a718714cba19d4c6f5f29d67e50acb0f9cdf4990d5a3f9e984b
-
C:\Windows\SysWOW64\uvdAXaPP.exeFilesize
284KB
MD5bf76d38a92d92b208c60c8a4004110c3
SHA1ccefd7aa5fcafc7dfb6d20e43b3640ab24871d2f
SHA256cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1
SHA5129d360af90ea08351e84bbecd133f842688f75262376aab2fdadf7a0f8c34a0ab771cbfd1c6389a718714cba19d4c6f5f29d67e50acb0f9cdf4990d5a3f9e984b
-
C:\Windows\SysWOW64\uvdAXaPP.exeFilesize
284KB
MD5bf76d38a92d92b208c60c8a4004110c3
SHA1ccefd7aa5fcafc7dfb6d20e43b3640ab24871d2f
SHA256cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1
SHA5129d360af90ea08351e84bbecd133f842688f75262376aab2fdadf7a0f8c34a0ab771cbfd1c6389a718714cba19d4c6f5f29d67e50acb0f9cdf4990d5a3f9e984b
-
C:\Windows\SysWOW64\uvdAXaPP.exeFilesize
284KB
MD5bf76d38a92d92b208c60c8a4004110c3
SHA1ccefd7aa5fcafc7dfb6d20e43b3640ab24871d2f
SHA256cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1
SHA5129d360af90ea08351e84bbecd133f842688f75262376aab2fdadf7a0f8c34a0ab771cbfd1c6389a718714cba19d4c6f5f29d67e50acb0f9cdf4990d5a3f9e984b
-
C:\Windows\SysWOW64\uvdAXaPP.exeFilesize
284KB
MD5bf76d38a92d92b208c60c8a4004110c3
SHA1ccefd7aa5fcafc7dfb6d20e43b3640ab24871d2f
SHA256cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1
SHA5129d360af90ea08351e84bbecd133f842688f75262376aab2fdadf7a0f8c34a0ab771cbfd1c6389a718714cba19d4c6f5f29d67e50acb0f9cdf4990d5a3f9e984b
-
\Windows\SysWOW64\uvdAXaPP.exeFilesize
284KB
MD5bf76d38a92d92b208c60c8a4004110c3
SHA1ccefd7aa5fcafc7dfb6d20e43b3640ab24871d2f
SHA256cb828162dd083cf50a0c0e8a43b9d4a6ce54c0c6a12bf2e4bed364117b74d0c1
SHA5129d360af90ea08351e84bbecd133f842688f75262376aab2fdadf7a0f8c34a0ab771cbfd1c6389a718714cba19d4c6f5f29d67e50acb0f9cdf4990d5a3f9e984b
-
memory/984-95-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB
-
memory/984-96-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB
-
memory/984-66-0x0000000000400000-0x000000000045A200-memory.dmpFilesize
360KB
-
memory/984-67-0x00000000002D0000-0x00000000002DB000-memory.dmpFilesize
44KB
-
memory/984-68-0x00000000002D0000-0x00000000002DB000-memory.dmpFilesize
44KB
-
memory/984-69-0x0000000000590000-0x000000000059B000-memory.dmpFilesize
44KB
-
memory/984-70-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/984-103-0x00000000002D0000-0x00000000002DB000-memory.dmpFilesize
44KB
-
memory/984-94-0x0000000000590000-0x000000000059B000-memory.dmpFilesize
44KB
-
memory/984-101-0x0000000000400000-0x000000000045A200-memory.dmpFilesize
360KB
-
memory/984-93-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/984-97-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1180-65-0x0000000000400000-0x000000000045A200-memory.dmpFilesize
360KB
-
memory/1324-61-0x0000000000400000-0x000000000045A200-memory.dmpFilesize
360KB
-
memory/2004-63-0x0000000000400000-0x000000000045A200-memory.dmpFilesize
360KB