Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
29-06-2023 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57d2555438d69ce2f31f38bf09ac7fc3b536d272aa3eb50701d9e14a5f8bb425.dll
Resource
win7-20230621-en
windows7-x64
5 signatures
150 seconds
General
-
Target
57d2555438d69ce2f31f38bf09ac7fc3b536d272aa3eb50701d9e14a5f8bb425.dll
-
Size
1.4MB
-
MD5
b0eeb9ddc03bb0f2ef677fc1c756cc4e
-
SHA1
40d5349e77c4e01a0c1d2628616301ce21f8e479
-
SHA256
57d2555438d69ce2f31f38bf09ac7fc3b536d272aa3eb50701d9e14a5f8bb425
-
SHA512
ca9f9bad72b45d56f80fb5b199414246ffcd20afa2a4ef55a94bd3ada547077e995e4b6e6568d814a94b4661053afc892847e7d71eec3e18b582f5d0c921cb87
-
SSDEEP
24576:N58E90z5gLu8fV75D2rD8k8wdlVQal04rztQkpa5WSLTt9mCAzpjUT6k7MVOVTaH:dygLuMVYrDFLl0z7gSL2xQ6kEIehZv
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1108-54-0x0000000010000000-0x00000000103C2000-memory.dmp family_blackmoon -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 1108 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 1108 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2036 wrote to memory of 1108 2036 rundll32.exe rundll32.exe PID 2036 wrote to memory of 1108 2036 rundll32.exe rundll32.exe PID 2036 wrote to memory of 1108 2036 rundll32.exe rundll32.exe PID 2036 wrote to memory of 1108 2036 rundll32.exe rundll32.exe PID 2036 wrote to memory of 1108 2036 rundll32.exe rundll32.exe PID 2036 wrote to memory of 1108 2036 rundll32.exe rundll32.exe PID 2036 wrote to memory of 1108 2036 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\57d2555438d69ce2f31f38bf09ac7fc3b536d272aa3eb50701d9e14a5f8bb425.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\57d2555438d69ce2f31f38bf09ac7fc3b536d272aa3eb50701d9e14a5f8bb425.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of SetWindowsHookEx