Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 20:46
Behavioral task
behavioral1
Sample
f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe
Resource
win7-20230831-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe
-
Size
6.3MB
-
MD5
34af455a79496079053d752444f7c133
-
SHA1
782cc8869f4cd29ac889efb9fd710badc5e3c6a3
-
SHA256
f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd
-
SHA512
8102d68df3d7009ab2b16e7ee05c27a45e04c22dc27fa2f863815054fbeb14ab41ee8b366e7c12f63b887c6220dbf5abce02479d6d2f5f9967d0cce0b3517405
-
SSDEEP
98304:iQlQLMlf7Y/UgejB5qzE0N8SiLKwESgjMxSox:1JyUL5qzEs8SiLKXSRNx
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral2/memory/4168-3-0x0000000000400000-0x0000000000AA7000-memory.dmp family_blackmoon behavioral2/memory/4168-10-0x0000000000400000-0x0000000000AA7000-memory.dmp family_blackmoon behavioral2/memory/4168-11-0x0000000000400000-0x0000000000AA7000-memory.dmp family_blackmoon behavioral2/memory/4168-44-0x0000000000400000-0x0000000000AA7000-memory.dmp family_blackmoon -
resource yara_rule behavioral2/memory/4168-1-0x0000000010000000-0x0000000010019000-memory.dmp upx behavioral2/memory/4168-0-0x0000000010000000-0x0000000010019000-memory.dmp upx behavioral2/memory/4168-13-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-14-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-15-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-17-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-20-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-23-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-25-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-28-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-30-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-33-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-36-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-39-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-41-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-43-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-46-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-49-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-48-0x0000000010000000-0x0000000010019000-memory.dmp upx behavioral2/memory/4168-52-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-54-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-56-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-58-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-60-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-62-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-64-0x00000000030F0000-0x000000000312E000-memory.dmp upx behavioral2/memory/4168-65-0x00000000030F0000-0x000000000312E000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dult.dll f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeDebugPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 1 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeCreateTokenPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeAssignPrimaryTokenPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeLockMemoryPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeIncreaseQuotaPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeMachineAccountPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeTcbPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeSecurityPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeTakeOwnershipPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeLoadDriverPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeSystemProfilePrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeSystemtimePrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeProfSingleProcessPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeIncBasePriorityPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeCreatePagefilePrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeCreatePermanentPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeBackupPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeRestorePrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeShutdownPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeDebugPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeAuditPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeSystemEnvironmentPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeChangeNotifyPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeRemoteShutdownPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeUndockPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeSyncAgentPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeEnableDelegationPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeManageVolumePrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeImpersonatePrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeCreateGlobalPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 31 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 32 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 33 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 34 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 35 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 36 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 37 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 38 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 39 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 40 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 41 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 42 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 43 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 44 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 45 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 46 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 47 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 48 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeDebugPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: SeDebugPrivilege 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe Token: 1 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe 4168 f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe"C:\Users\Admin\AppData\Local\Temp\f562469d7668aa9fa08e456c1aa7a2e5854e163f69b3d25a1983dbc00d1be0cd.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4168