Analysis
-
max time kernel
126s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/07/2023, 23:06
Static task
static1
Behavioral task
behavioral1
Sample
6f77680bd0773b2c76406195aa33eb23fd2b4f409d3dccb78a4737c20c0758b8.dll
Resource
win7-20230712-en
windows7-x64
General
-
Target
6f77680bd0773b2c76406195aa33eb23fd2b4f409d3dccb78a4737c20c0758b8.dll
-
Size
299KB
-
MD5
6e181fe5091721e07cfb6150f94e3b16
-
SHA1
4f6e690bc16856249cdbde121d007f7748c2dafd
-
SHA256
6f77680bd0773b2c76406195aa33eb23fd2b4f409d3dccb78a4737c20c0758b8
-
SHA512
1c9f87b50fb340db14f404111cebf8b01a3cf9cc5795edb6855afa1fa9a54445d692610bff51b6753feb01743aa23cc825f5fe1e6c107285e269b80fa1cbfc68
-
SSDEEP
6144:Mszj4kdmVXtO+ofngVeyytZlz5dnYAm/rTOyLq+HBunTBSqMcAO0X9:/jj2OPfgEyytZlz/WOyexnTg7cy
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/5092-156-0x0000000004E50000-0x0000000004EA6000-memory.dmp family_blackmoon behavioral2/memory/5092-163-0x0000000004E50000-0x0000000004EA6000-memory.dmp family_blackmoon -
Blocklisted process makes network request 7 IoCs
flow pid Process 5 5092 rundll32.exe 17 5092 rundll32.exe 32 5092 rundll32.exe 33 5092 rundll32.exe 34 5092 rundll32.exe 35 5092 rundll32.exe 44 5092 rundll32.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000800000002311c-151.dat acprotect behavioral2/files/0x000800000002311c-149.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 5092 rundll32.exe 5092 rundll32.exe -
resource yara_rule behavioral2/files/0x000800000002311c-151.dat upx behavioral2/memory/5092-156-0x0000000004E50000-0x0000000004EA6000-memory.dmp upx behavioral2/memory/5092-155-0x0000000004E50000-0x0000000004EA6000-memory.dmp upx behavioral2/files/0x000800000002311c-149.dat upx behavioral2/memory/5092-163-0x0000000004E50000-0x0000000004EA6000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\hErHcp.dll rundll32.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe 5092 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5092 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2056 wrote to memory of 5092 2056 rundll32.exe 74 PID 2056 wrote to memory of 5092 2056 rundll32.exe 74 PID 2056 wrote to memory of 5092 2056 rundll32.exe 74
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f77680bd0773b2c76406195aa33eb23fd2b4f409d3dccb78a4737c20c0758b8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f77680bd0773b2c76406195aa33eb23fd2b4f409d3dccb78a4737c20c0758b8.dll,#12⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD55d4dc7d4d1601d29b039a966f85c183d
SHA18a021015de3684ab8a94af5d7af3342fd4d71568
SHA25689ea05c90a691024780c94976f7487b3700a6f25c161b9e8c5471be4a7ef7b4f
SHA512ea37e48ae6069999e23e90b9586a2f211c19fa048e1dda6652bee34e0e5fdf899ddfe09638eec1ff111118554819b0481a8c9a2ef908c8487863fc1fa4aa45e2
-
Filesize
205KB
MD55d4dc7d4d1601d29b039a966f85c183d
SHA18a021015de3684ab8a94af5d7af3342fd4d71568
SHA25689ea05c90a691024780c94976f7487b3700a6f25c161b9e8c5471be4a7ef7b4f
SHA512ea37e48ae6069999e23e90b9586a2f211c19fa048e1dda6652bee34e0e5fdf899ddfe09638eec1ff111118554819b0481a8c9a2ef908c8487863fc1fa4aa45e2