Behavioral task
behavioral1
Sample
983f29123ad6c0120b86e880c177e7f6777f0ec3ca6e4a3c28823a5c8a7d1e6a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
983f29123ad6c0120b86e880c177e7f6777f0ec3ca6e4a3c28823a5c8a7d1e6a.exe
Resource
win10v2004-20230915-en
General
-
Target
983f29123ad6c0120b86e880c177e7f6777f0ec3ca6e4a3c28823a5c8a7d1e6a
-
Size
5.4MB
-
MD5
9e86362288d46c0d34edcc9cc0370206
-
SHA1
39dfe7fd6d28dd0dec962533345b88212ae658cd
-
SHA256
983f29123ad6c0120b86e880c177e7f6777f0ec3ca6e4a3c28823a5c8a7d1e6a
-
SHA512
5bce1b101d8b43c77d4f28087282cebb626ec9fccd2990348e9d35f134e064be4228a3e41b881bc16b8f30be93ec89daf2c18e2f5686921d0ad9dec0638d69d6
-
SSDEEP
98304:sPX6zGHuUJF90hZuQU0nDu1rvE6M7rH4AwbFewS1/le+m/qGdKgsKMkTclwrm:xzAuUyuB0Dude3H4CZlel/JY6MkTlr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 983f29123ad6c0120b86e880c177e7f6777f0ec3ca6e4a3c28823a5c8a7d1e6a
Files
-
983f29123ad6c0120b86e880c177e7f6777f0ec3ca6e4a3c28823a5c8a7d1e6a.exe windows:4 windows x86
678e5e8bca6bf8bd360261e38dde7258
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
lstrcpynA
CreateToolhelp32Snapshot
RtlZeroMemory
LocalSize
CreateThread
VirtualProtect
GetModuleHandleA
lstrlenA
InterlockedDecrement
lstrlenW
lstrcmpA
lstrcmpiW
lstrcatW
MultiByteToWideChar
ResetEvent
GetModuleHandleW
LCMapStringA
FreeLibrary
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
TerminateProcess
RaiseException
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RtlUnwind
GetOEMCP
GetCPInfo
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GetModuleFileNameA
GetCommandLineA
GlobalFree
GetUserDefaultLCID
WritePrivateProfileStringA
GetTickCount
GetPrivateProfileStringA
IsBadReadPtr
HeapReAlloc
ExitProcess
GlobalUnlock
GlobalLock
GlobalAlloc
WaitForSingleObject
SetEvent
CreateEventW
lstrcmpW
lstrcmpiA
HeapDestroy
HeapCreate
GetAtomNameW
GetModuleFileNameW
InterlockedIncrement
WideCharToMultiByte
HeapFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
RtlMoveMemory
HeapAlloc
GetProcessHeap
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
CloseHandle
VirtualQueryEx
GetCommandLineW
GlobalFindAtomA
SetLastError
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalFree
LocalAlloc
GlobalDeleteAtom
GetCurrentThread
lstrcpyA
lstrcatA
MulDiv
CreateFileA
DeviceIoControl
CreatePipe
GetStartupInfoA
CreateProcessA
ReadFile
CreateMutexA
ReleaseMutex
GetLastError
OpenFileMappingA
InterlockedCompareExchange
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetComputerNameA
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
LeaveCriticalSection
GetCurrentProcess
iphlpapi
AddIPAddress
shlwapi
PathRemoveFileSpecW
StrTrimW
StrToIntW
wvnsprintfW
StrToIntExW
PathFileExistsA
PathFindFileNameW
ws2_32
inet_addr
closesocket
user32
PeekMessageA
FindWindowA
GetIconInfo
DestroyCursor
DestroyIcon
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
GetDesktopWindow
GetWindow
GetWindowTextA
CreateWindowExA
ShowWindow
SetLayeredWindowAttributes
GetClassNameA
GetCursorPos
GetAsyncKeyState
SetWindowRgn
BeginPaint
EndPaint
TrackMouseEvent
GetDlgItem
GetAncestor
SetWindowLongW
IsWindow
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
SetWindowPos
GetWindowRect
FillRect
GetNextDlgTabItem
SetFocus
GetDC
DrawTextA
ReleaseDC
OffsetRect
DefWindowProcW
GetWindowDC
ClientToScreen
InvalidateRect
MapWindowPoints
CreateIconFromResourceEx
LoadImageW
LoadIconW
CopyIcon
DrawIconEx
SetRect
GetFocus
GetMessageW
IsChild
TranslateMDISysAccel
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
CreateDialogIndirectParamA
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
SetActiveWindow
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetClassLongA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
GrayStringA
TabbedTextOutA
UnhookWindowsHookEx
SetWindowTextA
GetDlgCtrlID
PtInRect
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetActiveWindow
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
PostMessageA
UnregisterHotKey
SetWindowLongA
SendMessageA
RegisterHotKey
LoadBitmapA
CallWindowProcA
MsgWaitForMultipleObjects
DispatchMessageW
PostQuitMessage
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
CharLowerW
CharUpperW
PostMessageW
ScreenToClient
ValidateRect
UpdateWindow
MoveWindow
SetParent
SetWindowTextW
MessageBoxW
SetTimer
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
UpdateLayeredWindow
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
LoadStringW
SetMenuDefaultItem
SetMenuItemInfoW
gdi32
GetObjectA
CreatePatternBrush
CreateEllipticRgn
GetDIBits
CreateFontIndirectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
BitBlt
CreateRoundRectRgn
CreateDIBSection
CreateCompatibleDC
GetObjectW
SetViewportOrgEx
CreateSolidBrush
GetStockObject
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
DeleteObject
CreateFontA
GetDeviceCaps
TranslateCharsetInfo
CreateBitmap
SaveDC
RestoreDC
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetMapMode
shell32
CommandLineToArgvW
DragAcceptFiles
Shell_NotifyIconW
DragFinish
DragQueryFileW
DragQueryFileA
comctl32
InitCommonControlsEx
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_Destroy
ImageList_Create
ImageList_BeginDrag
ImageList_Add
ImageList_EndDrag
ord17
ole32
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString
CoRevokeClassObject
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
gdiplus
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipFlush
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipDeleteRegion
GdipDeletePath
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipImageSelectActiveFrame
GdipDeleteFont
GdipDeleteStringFormat
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipGetDC
GdipReleaseDC
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipSetInterpolationMode
GdipGetInterpolationMode
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdipSetWorldTransform
GdipGetWorldTransform
GdipDeleteMatrix
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipSetPageUnit
GdipGetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipGetDpiX
GdipGetDpiY
GdipTransformPoints
GdipTransformPointsI
GdipGetNearestColor
GdipDrawLine
GdipDrawArc
GdipDrawBezier
GdipDrawRectangle
GdipDrawEllipse
GdipDrawPie
GdipDrawPolygon
GdipDrawPath
GdipDrawCurve
GdipDrawCurve2
GdipDrawClosedCurve
GdipDrawClosedCurve2
GdipGraphicsClear
GdipFillPolygon
GdipFillEllipse
GdipFillPie
GdipFillPath
GdipFillClosedCurve
GdipFillClosedCurve2
GdipFillRegion
GdipDrawString
GdipMeasureString
GdipCreateRegion
GdipMeasureCharacterRanges
GdipDrawDriverString
GdipDrawImage
GdipDrawImageRectRect
GdipDrawImageRect
GdipDrawImagePoints
GdipDrawImagePointRect
GdipDrawImagePointsRect
GdipSetClipGraphics
GdipSetClipPath
GdipSetClipRect
GdipSetClipRegion
GdipSetClipHrgn
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipGetImageAttributesAdjustedPalette
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipResetClip
GdipCreatePath2
GdipCreatePath
GdipCreateFromHWND
GdipRotateMatrix
GdipTranslateMatrix
GdipCreateMatrix
GdipGetImageGraphicsContext
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetSolidFillColor
GdipSetSolidFillColor
GdipCreateSolidFill
GdipGetBrushType
GdipCloneBrush
GdipGetStringFormatMeasurableCharacterRangeCount
GdipSetStringFormatMeasurableCharacterRanges
GdipGetStringFormatDigitSubstitution
GdipSetStringFormatDigitSubstitution
GdipGetStringFormatTabStops
GdipGetStringFormatTabStopCount
GdipSetStringFormatTabStops
GdipGetStringFormatHotkeyPrefix
GdipSetStringFormatHotkeyPrefix
GdipGetStringFormatTrimming
GdipSetStringFormatTrimming
GdipGetStringFormatLineAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatAlign
GdipSetStringFormatAlign
GdipGetStringFormatFlags
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipStringFormatGetGenericDefault
GdipCreateStringFormat
GdipCreateHICONFromBitmap
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipSetImageAttributesColorMatrix
GdipCreateHBITMAPFromBitmap
GdipGetRegionScans
GdipCreateFromHDC
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipIsVisibleRect
GdipSaveGraphics
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipGetPropertyItem
GdipTranslateClip
GdipClonePath
atl
ord42
uxtheme
SetWindowTheme
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
oledlg
ord8
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
InitializeSecurityDescriptor
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
SetSecurityDescriptorDacl
RegCloseKey
Sections
.text Size: 913KB - Virtual size: 913KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 859KB - Virtual size: 965KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WDDS0 Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ