Behavioral task
behavioral1
Sample
6d4e1506a21d601dddab65bf1c4bf95ca1b7f3fa1d3556b556a78e7c804ed9c6.exe
Resource
win7-20230712-en
General
-
Target
6d4e1506a21d601dddab65bf1c4bf95ca1b7f3fa1d3556b556a78e7c804ed9c6
-
Size
732KB
-
MD5
1a2f61d589c797253c80fd2e67c3f614
-
SHA1
a07d7e5dce766b812b5e09f7fceb4c8a96a3ca90
-
SHA256
6d4e1506a21d601dddab65bf1c4bf95ca1b7f3fa1d3556b556a78e7c804ed9c6
-
SHA512
4628130f7e1ecf7ee9ecb4ade9868f872e1ba588cfb5b8583916b9585a2cd4e0ddd65b6b757e782a37652726a19101dbcbbc44802be7d9d416f991bdd5294e70
-
SSDEEP
6144:NPv/+c0yaVhZqfoP88cn5ZYFOBmXVWod0OkjDh4C6dRjDh4C6uTyodl9GO1222Zi:NPv/+c0TZqS88cgOBA3EDizDBTxl9GX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6d4e1506a21d601dddab65bf1c4bf95ca1b7f3fa1d3556b556a78e7c804ed9c6
Files
-
6d4e1506a21d601dddab65bf1c4bf95ca1b7f3fa1d3556b556a78e7c804ed9c6.exe windows x86
5ff3bc002ee1af9e49022c5fe0c0fe27
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
lstrcpynA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
Sleep
GetTickCount
GetCommandLineA
FreeLibrary
LCMapStringA
VirtualFree
IsBadCodePtr
SetUnhandledExceptionFilter
VirtualAlloc
RtlZeroMemory
GetEnvironmentVariableW
CreateProcessA
MultiByteToWideChar
ExpandEnvironmentStringsW
VirtualQueryEx
lstrcpyn
RtlMoveMemory
GetCommandLineW
CloseHandle
CreateToolhelp32Snapshot
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
GetStartupInfoA
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
WriteFile
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
user32
DispatchMessageA
TranslateMessage
GetMessageA
MsgWaitForMultipleObjects
MessageBoxA
PeekMessageA
wsprintfA
advapi32
LookupPrivilegeValueA
CloseServiceHandle
CreateProcessAsUserA
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
CreateServiceA
OpenProcessToken
StartServiceA
ChangeServiceConfig2A
OpenServiceA
iphlpapi
GetIpForwardTable
shell32
CommandLineToArgvW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
ws2_32
WSAStartup
oleaut32
VariantTimeToSystemTime
Sections
.text Size: 112KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 544KB - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE