Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
25-06-2023 20:02
Static task
static1
Behavioral task
behavioral1
Sample
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe
Resource
win7-20230621-en
General
-
Target
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe
-
Size
2.8MB
-
MD5
92cf3d8aa1571e9cb316763d4f08d307
-
SHA1
733244edc78131518599e963cea7766d31dd161a
-
SHA256
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e
-
SHA512
d9c737e2873cae27a328d85c8b01a72a0f86f52f77bf4821b870300b85ec556ce8aed854ecda6dc640b9fb336881541b064b79112e183e7753d5c4b2b54232dc
-
SSDEEP
49152:5cqyId46NIsQqBuoNbWpZ6ZbaHcYz5aAVKiw6ZWqTG93jJ3hWpVc:GbIC6N93BtIg3Yz5J/693k
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1824-63-0x0000000000400000-0x000000000040F000-memory.dmp family_blackmoon behavioral1/memory/1824-73-0x0000000000400000-0x000000000040F000-memory.dmp family_blackmoon -
Downloads MZ/PE file
-
Processes:
resource yara_rule \Users\Public\xiaodaxzqxia\jecxz.exe aspack_v212_v242 \Users\Public\xiaodaxzqxia\jecxz.exe aspack_v212_v242 C:\Users\Public\xiaodaxzqxia\jecxz.exe aspack_v212_v242 C:\Users\Public\xiaodaxzqxia\jecxz.exe aspack_v212_v242 -
Executes dropped EXE 2 IoCs
Processes:
jecxz.exev.exepid process 1824 jecxz.exe 592 v.exe -
Loads dropped DLL 4 IoCs
Processes:
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exepid process 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
jecxz.exedescription ioc process File opened (read-only) \??\B: jecxz.exe File opened (read-only) \??\G: jecxz.exe File opened (read-only) \??\H: jecxz.exe File opened (read-only) \??\J: jecxz.exe File opened (read-only) \??\K: jecxz.exe File opened (read-only) \??\V: jecxz.exe File opened (read-only) \??\O: jecxz.exe File opened (read-only) \??\P: jecxz.exe File opened (read-only) \??\S: jecxz.exe File opened (read-only) \??\T: jecxz.exe File opened (read-only) \??\E: jecxz.exe File opened (read-only) \??\F: jecxz.exe File opened (read-only) \??\I: jecxz.exe File opened (read-only) \??\L: jecxz.exe File opened (read-only) \??\M: jecxz.exe File opened (read-only) \??\R: jecxz.exe File opened (read-only) \??\N: jecxz.exe File opened (read-only) \??\Q: jecxz.exe File opened (read-only) \??\U: jecxz.exe File opened (read-only) \??\W: jecxz.exe File opened (read-only) \??\X: jecxz.exe File opened (read-only) \??\Y: jecxz.exe File opened (read-only) \??\Z: jecxz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
jecxz.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 jecxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz jecxz.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
jecxz.exepid process 1824 jecxz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exepid process 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exedescription pid process target process PID 1320 wrote to memory of 1824 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe jecxz.exe PID 1320 wrote to memory of 1824 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe jecxz.exe PID 1320 wrote to memory of 1824 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe jecxz.exe PID 1320 wrote to memory of 1824 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe jecxz.exe PID 1320 wrote to memory of 592 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe v.exe PID 1320 wrote to memory of 592 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe v.exe PID 1320 wrote to memory of 592 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe v.exe PID 1320 wrote to memory of 592 1320 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe v.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe"C:\Users\Admin\AppData\Local\Temp\fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\xiaodaxzqxia\jecxz.exeC:\Users\Public\xiaodaxzqxia\jecxz.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\luo0625\v.exe"C:\Users\Public\luo0625\v.exe" -o -d C:\Users\Public\luo0625 C:\Users\Public\luo0625\1112⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\luo0625\111Filesize
1.8MB
MD570b77073188ba395d97ef3b66cd7a90c
SHA17b1fcec20ebe04d6de1d22eabf19ea610b64006e
SHA25616ebd0cb83d51870f52d86040546f404a2399a8f96710feee7de191643d1514d
SHA51269e28ff1b79432f632c4ce26173bbe8d01437e6f1f5470f1da584469d291c3d2e0bcdad1073d363aae71f8a92a5738c14fc1cd6348e5d04cdb6a7848a7ae6da0
-
C:\Users\Public\luo0625\v.exeFilesize
161KB
MD5fecf803f7d84d4cfa81277298574d6e6
SHA10fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA25681046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4
-
C:\Users\Public\luo0625\v.exeFilesize
161KB
MD5fecf803f7d84d4cfa81277298574d6e6
SHA10fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA25681046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4
-
C:\Users\Public\xiaodaxzqxia\1Filesize
119KB
MD573b370c33c56e2e43a45c49124d54383
SHA134ed6f8b837fd6a1f5cc900c3af715ce01422015
SHA2560c3a79e3c4953c5c178b446376c4b999d769ebcd315887e640ecb03c788a2c2f
SHA512e265cc78ada3a4d355198c2f31f73b4c04e1ef08a3cba11bb4a0c7969b085f1a4ea26e44aa47a942507970277c073b253f76cfdde133b75b6c226cf3a4db7569
-
C:\Users\Public\xiaodaxzqxia\jecxz.exeFilesize
16KB
MD59a0dd06445e36d0c2fc29cbcfe11d8f9
SHA1a85b21b0b8bf3db76aa7a743dbd4898fd63cc4bb
SHA256a1edd40e6b9661df0937b96f3dc3709e9cdb32ea277bc996ae3df6b3f217fa92
SHA512fbd7bb36e7641817794e2818f27f2501e94cc7df7a871230d445d145e6102ffb0396b696a2e8f2cefee2fb473302ae5821e7a625b2c7fc906597c2d582011c77
-
C:\Users\Public\xiaodaxzqxia\jecxz.exeFilesize
16KB
MD59a0dd06445e36d0c2fc29cbcfe11d8f9
SHA1a85b21b0b8bf3db76aa7a743dbd4898fd63cc4bb
SHA256a1edd40e6b9661df0937b96f3dc3709e9cdb32ea277bc996ae3df6b3f217fa92
SHA512fbd7bb36e7641817794e2818f27f2501e94cc7df7a871230d445d145e6102ffb0396b696a2e8f2cefee2fb473302ae5821e7a625b2c7fc906597c2d582011c77
-
\Users\Public\luo0625\v.exeFilesize
161KB
MD5fecf803f7d84d4cfa81277298574d6e6
SHA10fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA25681046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4
-
\Users\Public\luo0625\v.exeFilesize
161KB
MD5fecf803f7d84d4cfa81277298574d6e6
SHA10fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA25681046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4
-
\Users\Public\xiaodaxzqxia\jecxz.exeFilesize
16KB
MD59a0dd06445e36d0c2fc29cbcfe11d8f9
SHA1a85b21b0b8bf3db76aa7a743dbd4898fd63cc4bb
SHA256a1edd40e6b9661df0937b96f3dc3709e9cdb32ea277bc996ae3df6b3f217fa92
SHA512fbd7bb36e7641817794e2818f27f2501e94cc7df7a871230d445d145e6102ffb0396b696a2e8f2cefee2fb473302ae5821e7a625b2c7fc906597c2d582011c77
-
\Users\Public\xiaodaxzqxia\jecxz.exeFilesize
16KB
MD59a0dd06445e36d0c2fc29cbcfe11d8f9
SHA1a85b21b0b8bf3db76aa7a743dbd4898fd63cc4bb
SHA256a1edd40e6b9661df0937b96f3dc3709e9cdb32ea277bc996ae3df6b3f217fa92
SHA512fbd7bb36e7641817794e2818f27f2501e94cc7df7a871230d445d145e6102ffb0396b696a2e8f2cefee2fb473302ae5821e7a625b2c7fc906597c2d582011c77
-
memory/592-94-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1320-71-0x0000000002C00000-0x0000000002C0F000-memory.dmpFilesize
60KB
-
memory/1320-72-0x0000000002C00000-0x0000000002C0F000-memory.dmpFilesize
60KB
-
memory/1824-74-0x0000000010000000-0x0000000010024000-memory.dmpFilesize
144KB
-
memory/1824-73-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1824-70-0x0000000010000000-0x0000000010024000-memory.dmpFilesize
144KB
-
memory/1824-65-0x0000000010000000-0x0000000010024000-memory.dmpFilesize
144KB
-
memory/1824-63-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB