Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2023 19:55
Behavioral task
behavioral1
Sample
a353294fa93d44d7a9c31d9914c11638a935df8237e5e06883bfab7fa6fa17ef.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
General
-
Target
a353294fa93d44d7a9c31d9914c11638a935df8237e5e06883bfab7fa6fa17ef.exe
-
Size
254KB
-
MD5
45a29043caac247386e01e89d77524df
-
SHA1
caa477316fd00cba099f259a830b8a9f11003023
-
SHA256
a353294fa93d44d7a9c31d9914c11638a935df8237e5e06883bfab7fa6fa17ef
-
SHA512
57e989b59d7cfe131e8a1f9e19b256fc7d05dfeefd957bfe38a05fccfa1439dde40ca6e85a3d8375a3560b5cbbf9b9f965f91b70576ee205f12dd22a19faa1f9
-
SSDEEP
6144:LxNVRrU+/2YMnBH/rRmuGd4XuWWvZC8juIHTcRCe6IjjoS:tNVRl2bBHtbBWvo8qIHbEoS
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4996-133-0x0000000000400000-0x00000000004CA000-memory.dmp family_blackmoon behavioral2/memory/4996-140-0x0000000000400000-0x00000000004CA000-memory.dmp family_blackmoon -
Processes:
resource yara_rule behavioral2/memory/4996-133-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral2/memory/4996-134-0x0000000003250000-0x0000000003286000-memory.dmp upx behavioral2/memory/4996-135-0x0000000003250000-0x0000000003286000-memory.dmp upx behavioral2/memory/4996-139-0x0000000003250000-0x0000000003286000-memory.dmp upx behavioral2/memory/4996-140-0x0000000000400000-0x00000000004CA000-memory.dmp upx