Behavioral task
behavioral1
Sample
358fa59d0061c49720dafacf98ed4c1b5612c5101206cad8a2524327fcb46178.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
358fa59d0061c49720dafacf98ed4c1b5612c5101206cad8a2524327fcb46178.exe
Resource
win10v2004-20230915-en
General
-
Target
358fa59d0061c49720dafacf98ed4c1b5612c5101206cad8a2524327fcb46178
-
Size
512KB
-
MD5
c08b9dad5fb337f4ab9a717c9d71ece3
-
SHA1
e1f1d8524ff893516168e84f24396e1934109a72
-
SHA256
358fa59d0061c49720dafacf98ed4c1b5612c5101206cad8a2524327fcb46178
-
SHA512
98fbe3b8d8bbf0a83817a4f0efbf7b55acca9e5f4b3a640dcd8f6c9bf24aabb21bd5a914f8a4b414005de206a0d4c3e766599d5f09f84f3acd3a2f70a33a61d0
-
SSDEEP
12288:OaLtA7VPsIMYukrcdh2iuEi6T/Dg85JOKq:OaLtA71DnPc2oFT/Dg8fO9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 358fa59d0061c49720dafacf98ed4c1b5612c5101206cad8a2524327fcb46178
Files
-
358fa59d0061c49720dafacf98ed4c1b5612c5101206cad8a2524327fcb46178.exe windows:4 windows x86
10fefba8838c4bc23c3157b6b590434a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
kernel32
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
VirtualFreeEx
lstrcpyn
CreatePipe
PeekNamedPipe
ReadFile
GetExitCodeProcess
Sleep
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
VirtualAllocEx
GetTickCount
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
FlushFileBuffers
RaiseException
SetStdHandle
CreateProcessW
OpenProcess
HeapFree
LocalFree
lstrcmpiW
LocalAlloc
FindClose
FindFirstFileW
MultiByteToWideChar
CloseHandle
Process32Next
CreateToolhelp32Snapshot
WideCharToMultiByte
lstrlenW
GlobalFree
RtlMoveMemory
GlobalAlloc
HeapAlloc
GetProcessHeap
GetLocalTime
LCMapStringW
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
SetFilePointer
InterlockedIncrement
GetStartupInfoA
GetVersion
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
user32
MessageBoxA
PeekMessageA
CreateDesktopW
TranslateMessage
DispatchMessageA
wsprintfA
GetMessageA
CallWindowProcA
WaitForInputIdle
CloseDesktop
advapi32
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegFlushKey
RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA
CreateProcessWithTokenW
DuplicateTokenEx
OpenProcessToken
CreateProcessAsUserW
LookupAccountSidW
shell32
SHGetSpecialFolderPathW
wtsapi32
WTSEnumerateProcessesW
WTSFreeMemory
oleaut32
VariantTimeToSystemTime
SystemTimeToVariantTime
Sections
.text Size: 140KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 352KB - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ