Behavioral task
behavioral1
Sample
68a6db89a5b793e51df4bdbce2890e2f900d450026791dd975cc9a034eecb7fe.exe
Resource
win7-20230831-en
General
-
Target
68a6db89a5b793e51df4bdbce2890e2f900d450026791dd975cc9a034eecb7fe
-
Size
775KB
-
MD5
5dfe47a8fcea2437e6acdd624fe82cbe
-
SHA1
fc1a9f5da685781586264e9f210810904e78ea61
-
SHA256
68a6db89a5b793e51df4bdbce2890e2f900d450026791dd975cc9a034eecb7fe
-
SHA512
d70c3fb3f8735295926031cd7c8d8d184c693c8ff5a8164bd100daca8fd5249d022c6dc390f5ecbdde42d5d17c4c32a001e8119fea37a0dbe7feab606ed07145
-
SSDEEP
24576:ODfx/TjKYGSR3NK5edoBU2TFpVDqXi7y:Sxrj5BR3ue6BU2TFSXiW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68a6db89a5b793e51df4bdbce2890e2f900d450026791dd975cc9a034eecb7fe
Files
-
68a6db89a5b793e51df4bdbce2890e2f900d450026791dd975cc9a034eecb7fe.exe windows x86
683c2bf10ba1e540b38a662cd7a02869
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessW
CloseHandle
PeekNamedPipe
ReadFile
GetExitCodeProcess
Sleep
lstrlenW
GetModuleFileNameW
GetEnvironmentVariableW
SetPriorityClass
GetCurrentProcess
GetCurrentThread
SetThreadPriority
ExitProcess
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
WaitForSingleObject
CreatePipe
GetCurrentDirectoryW
GetProcessHeap
GetModuleHandleA
HeapAlloc
HeapFree
IsBadReadPtr
CreateProcessA
GetStartupInfoA
SetFileAttributesA
WriteFile
CreateFileA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
FindClose
FindFirstFileW
TerminateProcess
MultiByteToWideChar
shlwapi
PathIsDirectoryW
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
SHChangeNotify
user32
CallWindowProcA
WaitForInputIdle
wsprintfA
MessageBoxA
advapi32
RegOpenKeyExA
RegCloseKey
RegSetValueExA
msvcrt
atoi
strstr
malloc
realloc
free
strchr
_ftol
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 749KB - Virtual size: 797KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 848B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE