Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2023 20:02
Static task
static1
Behavioral task
behavioral1
Sample
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe
Resource
win7-20230621-en
General
-
Target
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe
-
Size
2.8MB
-
MD5
92cf3d8aa1571e9cb316763d4f08d307
-
SHA1
733244edc78131518599e963cea7766d31dd161a
-
SHA256
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e
-
SHA512
d9c737e2873cae27a328d85c8b01a72a0f86f52f77bf4821b870300b85ec556ce8aed854ecda6dc640b9fb336881541b064b79112e183e7753d5c4b2b54232dc
-
SSDEEP
49152:5cqyId46NIsQqBuoNbWpZ6ZbaHcYz5aAVKiw6ZWqTG93jJ3hWpVc:GbIC6N93BtIg3Yz5J/693k
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4284-138-0x0000000000400000-0x000000000040F000-memory.dmp family_blackmoon behavioral2/memory/4284-147-0x0000000000400000-0x000000000040F000-memory.dmp family_blackmoon -
Downloads MZ/PE file
-
Processes:
resource yara_rule C:\Users\Public\xiaodaxzqxia\jecxz.exe aspack_v212_v242 C:\Users\Public\xiaodaxzqxia\jecxz.exe aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Control Panel\International\Geo\Nation fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe -
Executes dropped EXE 4 IoCs
Processes:
jecxz.exev.exev.exev.exepid process 4284 jecxz.exe 2452 v.exe 1016 v.exe 4444 v.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
jecxz.exedescription ioc process File opened (read-only) \??\J: jecxz.exe File opened (read-only) \??\K: jecxz.exe File opened (read-only) \??\M: jecxz.exe File opened (read-only) \??\O: jecxz.exe File opened (read-only) \??\Y: jecxz.exe File opened (read-only) \??\B: jecxz.exe File opened (read-only) \??\I: jecxz.exe File opened (read-only) \??\L: jecxz.exe File opened (read-only) \??\R: jecxz.exe File opened (read-only) \??\V: jecxz.exe File opened (read-only) \??\X: jecxz.exe File opened (read-only) \??\Z: jecxz.exe File opened (read-only) \??\E: jecxz.exe File opened (read-only) \??\H: jecxz.exe File opened (read-only) \??\N: jecxz.exe File opened (read-only) \??\P: jecxz.exe File opened (read-only) \??\Q: jecxz.exe File opened (read-only) \??\S: jecxz.exe File opened (read-only) \??\T: jecxz.exe File opened (read-only) \??\W: jecxz.exe File opened (read-only) \??\G: jecxz.exe File opened (read-only) \??\U: jecxz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
jecxz.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 jecxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz jecxz.exe -
Modifies registry class 1 IoCs
Processes:
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\Local Settings fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
jecxz.exepid process 4284 jecxz.exe 4284 jecxz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exepid process 3028 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe 3028 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exedescription pid process target process PID 3028 wrote to memory of 4284 3028 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe jecxz.exe PID 3028 wrote to memory of 4284 3028 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe jecxz.exe PID 3028 wrote to memory of 4284 3028 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe jecxz.exe PID 3028 wrote to memory of 2452 3028 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe v.exe PID 3028 wrote to memory of 2452 3028 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe v.exe PID 3028 wrote to memory of 2452 3028 fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe v.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe"C:\Users\Admin\AppData\Local\Temp\fe1b1277eee792a9684afda06569506e29b0816f61e8957964efdb9f2c4e3e5e.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\xiaodaxzqxia\jecxz.exeC:\Users\Public\xiaodaxzqxia\jecxz.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\luo0625\v.exe"C:\Users\Public\luo0625\v.exe" -o -d C:\Users\Public\luo0625 C:\Users\Public\luo0625\1112⤵
- Executes dropped EXE
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Public\luo0625\v.exe"C:\Users\Public\luo0625\v.exe" -n -d C:\ProgramData C:\Users\Public\luo0625\b1⤵
- Executes dropped EXE
-
C:\Users\Public\luo0625\v.exe"C:\Users\Public\luo0625\v.exe" -n -d C:\ProgramData C:\Users\Public\luo0625\b1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\luo06250323.lnkFilesize
1KB
MD546441828a7c4210d65c518b977eb3a30
SHA1e90844b9f34f4ac8e07ead623ed342c06be85d9d
SHA2565fe723b2df30a1b4f72b3c558112cdf9e9cc14970fcaddd68bc426dfd14c3f45
SHA512399a89fb654e8bba8b3f098e51fee0a09469f432822e2fd89d85d193bb11ee2070b228cfd15069b354e32c6aff54374b0a7fdaade7c8474f548b1059881b14e8
-
C:\Users\Public\luo0625\111Filesize
1.8MB
MD570b77073188ba395d97ef3b66cd7a90c
SHA17b1fcec20ebe04d6de1d22eabf19ea610b64006e
SHA25616ebd0cb83d51870f52d86040546f404a2399a8f96710feee7de191643d1514d
SHA51269e28ff1b79432f632c4ce26173bbe8d01437e6f1f5470f1da584469d291c3d2e0bcdad1073d363aae71f8a92a5738c14fc1cd6348e5d04cdb6a7848a7ae6da0
-
C:\Users\Public\luo0625\bFilesize
1KB
MD59b37095f82ce27b4191f3a9ba1778c78
SHA1524f6a10b2146e0bef7ff87283087364d32df1a2
SHA256a0e867f5edd9a76b095362b987cd7a29be99070f2c87a64a3d42f6019a8f8eba
SHA51261ec2b25c95b1fe622fcd4e23364733996bcb079df33ca32d109efbdcade28498e1adc5941db20eb1d78a596dd5a024c460eab5526e7b930e38da265135f4342
-
C:\Users\Public\luo0625\v.exeFilesize
161KB
MD5fecf803f7d84d4cfa81277298574d6e6
SHA10fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA25681046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4
-
C:\Users\Public\luo0625\v.exeFilesize
161KB
MD5fecf803f7d84d4cfa81277298574d6e6
SHA10fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA25681046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4
-
C:\Users\Public\luo0625\v.exeFilesize
161KB
MD5fecf803f7d84d4cfa81277298574d6e6
SHA10fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA25681046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4
-
C:\Users\Public\luo0625\v.exeFilesize
161KB
MD5fecf803f7d84d4cfa81277298574d6e6
SHA10fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA25681046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4
-
C:\Users\Public\xiaodaxzqxia\1Filesize
119KB
MD573b370c33c56e2e43a45c49124d54383
SHA134ed6f8b837fd6a1f5cc900c3af715ce01422015
SHA2560c3a79e3c4953c5c178b446376c4b999d769ebcd315887e640ecb03c788a2c2f
SHA512e265cc78ada3a4d355198c2f31f73b4c04e1ef08a3cba11bb4a0c7969b085f1a4ea26e44aa47a942507970277c073b253f76cfdde133b75b6c226cf3a4db7569
-
C:\Users\Public\xiaodaxzqxia\jecxz.exeFilesize
16KB
MD59a0dd06445e36d0c2fc29cbcfe11d8f9
SHA1a85b21b0b8bf3db76aa7a743dbd4898fd63cc4bb
SHA256a1edd40e6b9661df0937b96f3dc3709e9cdb32ea277bc996ae3df6b3f217fa92
SHA512fbd7bb36e7641817794e2818f27f2501e94cc7df7a871230d445d145e6102ffb0396b696a2e8f2cefee2fb473302ae5821e7a625b2c7fc906597c2d582011c77
-
C:\Users\Public\xiaodaxzqxia\jecxz.exeFilesize
16KB
MD59a0dd06445e36d0c2fc29cbcfe11d8f9
SHA1a85b21b0b8bf3db76aa7a743dbd4898fd63cc4bb
SHA256a1edd40e6b9661df0937b96f3dc3709e9cdb32ea277bc996ae3df6b3f217fa92
SHA512fbd7bb36e7641817794e2818f27f2501e94cc7df7a871230d445d145e6102ffb0396b696a2e8f2cefee2fb473302ae5821e7a625b2c7fc906597c2d582011c77
-
memory/1016-168-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2452-163-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4284-146-0x0000000010000000-0x0000000010024000-memory.dmpFilesize
144KB
-
memory/4284-147-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/4284-145-0x0000000010000000-0x0000000010024000-memory.dmpFilesize
144KB
-
memory/4284-140-0x0000000010000000-0x0000000010024000-memory.dmpFilesize
144KB
-
memory/4284-138-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/4444-176-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB