Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2023 20:54
Behavioral task
behavioral1
Sample
2fc6268a29cc4635b072b778e8cdc5074fe802eaf7c7b2c6106988fc6370ad82.exe
Resource
win7-20230220-en
4 signatures
150 seconds
General
-
Target
2fc6268a29cc4635b072b778e8cdc5074fe802eaf7c7b2c6106988fc6370ad82.exe
-
Size
647KB
-
MD5
9271a7ce118bc6c89039817958d41ebe
-
SHA1
f054fcb5e3af4f5511b01522d8f0872defed0f85
-
SHA256
2fc6268a29cc4635b072b778e8cdc5074fe802eaf7c7b2c6106988fc6370ad82
-
SHA512
2e6ad30fecbae589ce29678d296f8c69a05f9c05a3c555858f177da28ef22b05182e4ed6bad33c83dbaf3996e8a1e5001640d308604556226a43722cf9c4e6f7
-
SSDEEP
12288:d6IZNik0eAMp0PpXcD0pvkbLu/NMI9btnZJ+8Uk:pok0e1peQ0pvkPu/NM+n1F
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/3040-134-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-136-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-135-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-140-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-141-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-142-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-143-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-144-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-145-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-146-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-147-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-148-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-149-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-150-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-151-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-152-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-153-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon behavioral2/memory/3040-154-0x0000000000400000-0x000000000061D000-memory.dmp family_blackmoon -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2fc6268a29cc4635b072b778e8cdc5074fe802eaf7c7b2c6106988fc6370ad82.exepid process 3040 2fc6268a29cc4635b072b778e8cdc5074fe802eaf7c7b2c6106988fc6370ad82.exe 3040 2fc6268a29cc4635b072b778e8cdc5074fe802eaf7c7b2c6106988fc6370ad82.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3040-133-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-134-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-136-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-135-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-137-0x0000000010000000-0x0000000010009000-memory.dmpFilesize
36KB
-
memory/3040-140-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-141-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-142-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-143-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-144-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-145-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-146-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-147-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-148-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-149-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-150-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-151-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-152-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-153-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB
-
memory/3040-154-0x0000000000400000-0x000000000061D000-memory.dmpFilesize
2.1MB