Analysis
-
max time kernel
29s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2023 20:17
Behavioral task
behavioral1
Sample
1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe
Resource
win7-20230220-en
General
-
Target
1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe
-
Size
2.5MB
-
MD5
78679889e7ea520bee19a917e706ac91
-
SHA1
8d9e3c13d80025a4dd0639df4ffc2219966c6a5b
-
SHA256
1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7
-
SHA512
73972aa04b3d8a340762b16d4cb2a9ce0713d11a2d46a4e8de81b9080e26882b3ee9a8be63b277aabd437292e89580e943c7b7233eb067575e21471c48f72fe6
-
SSDEEP
6144:NLX+b8IWAUTEOXhjpztpygGN3JQL8+r5m:NLX+4II4OXhjp1EQG
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\NJbAZZrX.exe family_blackmoon C:\Windows\SysWOW64\NJbAZZrX.exe family_blackmoon C:\Windows\SysWOW64\NJbAZZrX.exe family_blackmoon C:\Windows\SysWOW64\NJbAZZrX.exe family_blackmoon C:\Windows\SysWOW64\NJbAZZrX.exe family_blackmoon C:\Windows\SysWOW64\NJbAZZrX.exe family_blackmoon -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1948 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
NJbAZZrX.exeNJbAZZrX.exeNJbAZZrX.exepid process 1736 NJbAZZrX.exe 588 NJbAZZrX.exe 772 NJbAZZrX.exe -
Loads dropped DLL 1 IoCs
Processes:
1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exepid process 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe -
Processes:
resource yara_rule behavioral1/memory/772-63-0x0000000000290000-0x000000000029B000-memory.dmp upx behavioral1/memory/772-64-0x0000000000290000-0x000000000029B000-memory.dmp upx behavioral1/memory/772-65-0x0000000000530000-0x000000000053B000-memory.dmp upx behavioral1/memory/772-90-0x0000000000530000-0x000000000053B000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exedescription ioc process File created C:\Windows\SysWOW64\NJbAZZrX.exe 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe File opened for modification C:\Windows\SysWOW64\NJbAZZrX.exe 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
NJbAZZrX.exepid process 772 NJbAZZrX.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exeNJbAZZrX.exedescription pid process Token: SeIncBasePriorityPrivilege 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe Token: SeDebugPrivilege 772 NJbAZZrX.exe Token: SeDebugPrivilege 772 NJbAZZrX.exe Token: SeDebugPrivilege 772 NJbAZZrX.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exeNJbAZZrX.exeNJbAZZrX.exeNJbAZZrX.exepid process 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe 1736 NJbAZZrX.exe 588 NJbAZZrX.exe 772 NJbAZZrX.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exeNJbAZZrX.exedescription pid process target process PID 1396 wrote to memory of 1736 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe NJbAZZrX.exe PID 1396 wrote to memory of 1736 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe NJbAZZrX.exe PID 1396 wrote to memory of 1736 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe NJbAZZrX.exe PID 1396 wrote to memory of 1736 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe NJbAZZrX.exe PID 1396 wrote to memory of 1948 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe cmd.exe PID 1396 wrote to memory of 1948 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe cmd.exe PID 1396 wrote to memory of 1948 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe cmd.exe PID 1396 wrote to memory of 1948 1396 1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe cmd.exe PID 588 wrote to memory of 772 588 NJbAZZrX.exe NJbAZZrX.exe PID 588 wrote to memory of 772 588 NJbAZZrX.exe NJbAZZrX.exe PID 588 wrote to memory of 772 588 NJbAZZrX.exe NJbAZZrX.exe PID 588 wrote to memory of 772 588 NJbAZZrX.exe NJbAZZrX.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe"C:\Users\Admin\AppData\Local\Temp\1389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NJbAZZrX.exe"C:\Windows\system32\NJbAZZrX.exe" -auto2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1389F6~1.EXE > nul2⤵
- Deletes itself
-
C:\Windows\SysWOW64\NJbAZZrX.exeC:\Windows\SysWOW64\NJbAZZrX.exe Service 11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NJbAZZrX.exe-ojbk2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\NJbAZZrX.exeFilesize
2.5MB
MD578679889e7ea520bee19a917e706ac91
SHA18d9e3c13d80025a4dd0639df4ffc2219966c6a5b
SHA2561389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7
SHA51273972aa04b3d8a340762b16d4cb2a9ce0713d11a2d46a4e8de81b9080e26882b3ee9a8be63b277aabd437292e89580e943c7b7233eb067575e21471c48f72fe6
-
C:\Windows\SysWOW64\NJbAZZrX.exeFilesize
2.5MB
MD578679889e7ea520bee19a917e706ac91
SHA18d9e3c13d80025a4dd0639df4ffc2219966c6a5b
SHA2561389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7
SHA51273972aa04b3d8a340762b16d4cb2a9ce0713d11a2d46a4e8de81b9080e26882b3ee9a8be63b277aabd437292e89580e943c7b7233eb067575e21471c48f72fe6
-
C:\Windows\SysWOW64\NJbAZZrX.exeFilesize
2.5MB
MD578679889e7ea520bee19a917e706ac91
SHA18d9e3c13d80025a4dd0639df4ffc2219966c6a5b
SHA2561389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7
SHA51273972aa04b3d8a340762b16d4cb2a9ce0713d11a2d46a4e8de81b9080e26882b3ee9a8be63b277aabd437292e89580e943c7b7233eb067575e21471c48f72fe6
-
C:\Windows\SysWOW64\NJbAZZrX.exeFilesize
2.5MB
MD578679889e7ea520bee19a917e706ac91
SHA18d9e3c13d80025a4dd0639df4ffc2219966c6a5b
SHA2561389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7
SHA51273972aa04b3d8a340762b16d4cb2a9ce0713d11a2d46a4e8de81b9080e26882b3ee9a8be63b277aabd437292e89580e943c7b7233eb067575e21471c48f72fe6
-
C:\Windows\SysWOW64\NJbAZZrX.exeFilesize
2.5MB
MD578679889e7ea520bee19a917e706ac91
SHA18d9e3c13d80025a4dd0639df4ffc2219966c6a5b
SHA2561389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7
SHA51273972aa04b3d8a340762b16d4cb2a9ce0713d11a2d46a4e8de81b9080e26882b3ee9a8be63b277aabd437292e89580e943c7b7233eb067575e21471c48f72fe6
-
\Windows\SysWOW64\NJbAZZrX.exeFilesize
2.5MB
MD578679889e7ea520bee19a917e706ac91
SHA18d9e3c13d80025a4dd0639df4ffc2219966c6a5b
SHA2561389f6030ca4c578052e086f9df78c8c70d4fc17355eba0f247d93e38654dbf7
SHA51273972aa04b3d8a340762b16d4cb2a9ce0713d11a2d46a4e8de81b9080e26882b3ee9a8be63b277aabd437292e89580e943c7b7233eb067575e21471c48f72fe6
-
memory/772-63-0x0000000000290000-0x000000000029B000-memory.dmpFilesize
44KB
-
memory/772-64-0x0000000000290000-0x000000000029B000-memory.dmpFilesize
44KB
-
memory/772-65-0x0000000000530000-0x000000000053B000-memory.dmpFilesize
44KB
-
memory/772-66-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/772-89-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/772-90-0x0000000000530000-0x000000000053B000-memory.dmpFilesize
44KB
-
memory/772-91-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/772-93-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/772-94-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB