blackmoon | 97b248ad9ac1f6e5e74e56e9dc04a0f2d7d9d100a09aa195d2f9a1f4200d7d71_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
97b248ad9ac1f6e5e74e56e9dc04a0f2d7d9d100a09aa195d2f9a1f4200d7d71_JC.exe
Size 10.6MB
Sample231012-1rnr4seb43
SHA256 97b248ad9ac1f6e5e74e56e9dc04a0f2d7d9d100a09aa195d2f9a1f4200d7d71
MD5 52357e84aa59cd9c87947b300f79cdaa
SHA1 5de0af611ed860b2b3500efb527ecda0b1e574c8
SHA512 de1ba269d20900eae9f6c4622d448e82b38d9372791c0a7525975f2d30696e68bcc076a42819e8e43deaf23b6e217e268d2724fefc0a7be42986088db1592ed5
SSDEEP 196608:ibkRZ2EUMlupztwdBRcet/X0dkZi5sUF26W2QFtJb:/ZOMluEcA8kOsUkwQFtJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97b248ad9ac1f6e5e74e56e9dc04a0f2d7d9d100a09aa195d2f9a1f4200d7d71_JC.exe

File Explorer

97b248ad9ac1f6e5e74e56e9dc04a0f2d7d9d100a09aa195d2f9a1f4200d7d71_JC.exe

.exe 10.6MB

97b248ad9ac1f6e5e74e56e9dc04a0f2d7d9d100a09aa195d2f9a1f4200d7d71_JC.exe

IMPHASH e7ffc4b3ab929932fd3e9192d196cb54
SHA256 97b248ad9ac1f6e5e74e56e9dc04a0f2d7d9d100a09aa195d2f9a1f4200d7d71
MD5 52357e84aa59cd9c87947b300f79cdaa
SHA1 5de0af611ed860b2b3500efb527ecda0b1e574c8
SHA512 de1ba269d20900eae9f6c4622d448e82b38d9372791c0a7525975f2d30696e68bcc076a42819e8e43deaf23b6e217e268d2724fefc0a7be42986088db1592ed5
SSDEEP 196608:ibkRZ2EUMlupztwdBRcet/X0dkZi5sUF26W2QFtJb:/ZOMluEcA8kOsUkwQFtJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86

Detect Blackmoon payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

824519

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement SuspendThread TerminateThread ReleaseMutex CreateMutexA GetStartupInfoA WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA SetStdHandle IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize WriteFile WaitForMultipleObjects CreateFileA DeviceIoControl SetEvent FindResourceA LoadResource LockResource ReadFile CreatePipe GetExitCodeProcess GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA TerminateProcess RaiseException GetLocalTime GetSystemTime GetTimeZoneInformation RtlUnwind GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle LockFile UnlockFile SetEndOfFile lstrcmpiA InterlockedIncrement

user32

WaitForInputIdle wsprintfA CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent IsWindow PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow EqualRect GetWindowRect SetForegroundWindow DestroyMenu IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetSysColor SetWindowLongA GetWindowLongA RedrawWindow EnableWindow IsWindowVisible OffsetRect PtInRect DestroyIcon IntersectRect InflateRect SetRect SetScrollPos SetScrollRange GetScrollRange SetCapture GetCapture ReleaseCapture SetTimer KillTimer WinHelpA LoadBitmapA GetForegroundWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos UnregisterClassA AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect

gdi32

StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreatePalette CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn GetSystemPaletteEntries CreateDIBitmap DeleteObject SelectClipRgn CreatePolygonRgn GetClipRgn SetStretchBltMode CreateRectRgnIndirect SetBkColor GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx

winmm

midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutRestart

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegQueryValueA RegSetValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA

ole32

OleInitialize OleUninitialize CLSIDFromString

oleaut32

RegisterTypeLi LoadTypeLi UnRegisterTypeLi

comctl32

ImageList_Destroy ord17

ws2_32

socket recvfrom ioctlsocket connect recv getpeername accept htons ntohl WSAAsyncSelect closesocket send WSACleanup WSAStartup inet_ntoa inet_addr

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseColorA