Analysis
-
max time kernel
135s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2023 08:45
Behavioral task
behavioral1
Sample
a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe
Resource
win7-20230220-en
General
-
Target
a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe
-
Size
146KB
-
MD5
0558b31bd9e3e8233ca74837754882d7
-
SHA1
a4bcad094372c9348bce850034a028460d19b0a6
-
SHA256
a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda
-
SHA512
4e8cb6bcd0b74b5508ee211fb2d7796fc5177d3b10fdc3283614ae872bd4cfa32d80648e35c79b2b2b3fa867eadcce4e706301f6e716e46fddefca08eeb1fb04
-
SSDEEP
3072:GB1Q3LeTWmL359vd0OmS7ok57ORL2G4kOqOcPxab/gp2pFuuxE6l/:E1WeTWmLp9vd0Om6B57ORaG4Rqh51p2q
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1160-58-0x0000000000400000-0x0000000000481000-memory.dmp family_blackmoon behavioral1/memory/1160-59-0x0000000000400000-0x0000000000481000-memory.dmp family_blackmoon -
Gh0st RAT payload 7 IoCs
Processes:
resource yara_rule \Windows\Logs\RunDllExe.dll family_gh0strat behavioral1/memory/1864-56-0x0000000000400000-0x000000000040B000-memory.dmp family_gh0strat behavioral1/memory/1864-57-0x0000000000400000-0x000000000040B000-memory.dmp family_gh0strat behavioral1/memory/1160-58-0x0000000000400000-0x0000000000481000-memory.dmp family_gh0strat behavioral1/memory/1160-59-0x0000000000400000-0x0000000000481000-memory.dmp family_gh0strat behavioral1/memory/1872-62-0x00000000024F0000-0x0000000002530000-memory.dmp family_gh0strat behavioral1/memory/1872-63-0x00000000024F0000-0x0000000002530000-memory.dmp family_gh0strat -
Registers new Print Monitor 2 TTPs 2 IoCs
Processes:
a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe\Driver = "C:\\Windows\\Logs\\RunDllExe.dll" a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 1872 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
pid process 284 -
Processes:
resource yara_rule behavioral1/memory/1160-58-0x0000000000400000-0x0000000000481000-memory.dmp upx behavioral1/memory/1160-59-0x0000000000400000-0x0000000000481000-memory.dmp upx behavioral1/memory/1872-62-0x00000000024F0000-0x0000000002530000-memory.dmp upx -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 203.124.11.111 -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MpMgSvc[1].dll svchost.exe -
Drops file in Windows directory 1 IoCs
Processes:
a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exedescription ioc process File created C:\Windows\Logs\RunDllExe.dll a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7733E27F-B848-4ACE-81B7-F1A6720643B1} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7733E27F-B848-4ACE-81B7-F1A6720643B1}\WpadDecisionReason = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7733E27F-B848-4ACE-81B7-F1A6720643B1}\WpadNetworkName = "Network 2" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-58-c0-e5-ee-b5\WpadDecisionTime = a01368049d9ed901 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-58-c0-e5-ee-b5\WpadDecision = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-58-c0-e5-ee-b5 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7733E27F-B848-4ACE-81B7-F1A6720643B1}\82-58-c0-e5-ee-b5 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ae000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7733E27F-B848-4ACE-81B7-F1A6720643B1}\WpadDecisionTime = a01368049d9ed901 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7733E27F-B848-4ACE-81B7-F1A6720643B1}\WpadDecision = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-58-c0-e5-ee-b5\WpadDecisionReason = "1" svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exepowershell.exepid process 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe 1872 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1872 powershell.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exedescription pid process target process PID 1160 wrote to memory of 928 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 928 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 928 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 928 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 584 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 584 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 584 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 584 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 572 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 572 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 572 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 572 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1760 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1760 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1760 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1760 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 772 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 772 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 772 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 772 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 556 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 556 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 556 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 556 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 820 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 820 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 820 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 820 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1952 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1952 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1952 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1952 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1640 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1640 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1640 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1640 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 976 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 976 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 976 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 976 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1144 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1144 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1144 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1144 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe netsh.exe PID 1160 wrote to memory of 1872 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe powershell.exe PID 1160 wrote to memory of 1872 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe powershell.exe PID 1160 wrote to memory of 1872 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe powershell.exe PID 1160 wrote to memory of 1872 1160 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe"C:\Users\Admin\AppData\Local\Temp\a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe"1⤵
- Registers new Print Monitor
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Block2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filterlist name=Filter12⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=FilteraAtion1 action=block2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion12⤵
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Block assign=y2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\Admin\AppData\Local\Temp\a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\Logs\RunDllExe.dllFilesize
165KB
MD5fb8898c041c9671a3f31e7bcdb5b82f7
SHA15bdc36f86693c652f1551ed81848af9c7c6b4ec8
SHA2563df80c17dee30f35319c4296ff959d10fd41dc30975da3f1a33595c33d520ee9
SHA512b6c17676ce2a9e9f055a2d15b2651c595f09bab8def976acf7e07f74d44e7a9b04080d0a85934a8a5409634cc19137a26e94243de7322bc0781987f766fffaa9
-
memory/1160-58-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1160-59-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1864-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1864-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1872-62-0x00000000024F0000-0x0000000002530000-memory.dmpFilesize
256KB
-
memory/1872-63-0x00000000024F0000-0x0000000002530000-memory.dmpFilesize
256KB
-
memory/1872-64-0x00000000024F0000-0x0000000002530000-memory.dmpFilesize
256KB