Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2023 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57d2555438d69ce2f31f38bf0.dll
Resource
win7-20230621-en
windows7-x64
5 signatures
150 seconds
General
-
Target
57d2555438d69ce2f31f38bf0.dll
-
Size
1.4MB
-
MD5
b0eeb9ddc03bb0f2ef677fc1c756cc4e
-
SHA1
40d5349e77c4e01a0c1d2628616301ce21f8e479
-
SHA256
57d2555438d69ce2f31f38bf09ac7fc3b536d272aa3eb50701d9e14a5f8bb425
-
SHA512
ca9f9bad72b45d56f80fb5b199414246ffcd20afa2a4ef55a94bd3ada547077e995e4b6e6568d814a94b4661053afc892847e7d71eec3e18b582f5d0c921cb87
-
SSDEEP
24576:N58E90z5gLu8fV75D2rD8k8wdlVQal04rztQkpa5WSLTt9mCAzpjUT6k7MVOVTaH:dygLuMVYrDFLl0z7gSL2xQ6kEIehZv
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2056-133-0x0000000010000000-0x00000000103C2000-memory.dmp family_blackmoon -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 10 2056 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{02C3E692-07EA-431C-9534-B567C2ACBC0F}.catalogItem svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 2056 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1800 wrote to memory of 2056 1800 rundll32.exe rundll32.exe PID 1800 wrote to memory of 2056 1800 rundll32.exe rundll32.exe PID 1800 wrote to memory of 2056 1800 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\57d2555438d69ce2f31f38bf0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\57d2555438d69ce2f31f38bf0.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory