Behavioral task
behavioral1
Sample
5660e4e64209720160fa94b0096b3f71de5d7b88c8603a42324ad602482d71f3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5660e4e64209720160fa94b0096b3f71de5d7b88c8603a42324ad602482d71f3.exe
Resource
win10v2004-20230915-en
General
-
Target
5660e4e64209720160fa94b0096b3f71de5d7b88c8603a42324ad602482d71f3
-
Size
7.6MB
-
MD5
298ccd77f05c0e6bacf29486d48f468f
-
SHA1
5d305d4db53d7d047adae5fd45ca39951dc610b6
-
SHA256
5660e4e64209720160fa94b0096b3f71de5d7b88c8603a42324ad602482d71f3
-
SHA512
67cd4089ccaf62fbf361a8639b9fb55adbe38ccd600ee3e4fc713e5503dafb5ec8238f0ceecb8386ab0cf903d6fdf2061dfb5b06eab5b1880b8dbefe116a0e59
-
SSDEEP
196608:bXKBD7430ftxI4LL6+OYof/uZrZRMwnYI/H0BC:LgDW0ftTLbq+M+YI/sC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5660e4e64209720160fa94b0096b3f71de5d7b88c8603a42324ad602482d71f3
Files
-
5660e4e64209720160fa94b0096b3f71de5d7b88c8603a42324ad602482d71f3.exe windows:4 windows x86
16a82b04ce3ca60beef5007da1ab7ef4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
GetStdHandle
GetModuleFileNameA
ReadFile
GetFileSize
CreateFileA
ReadConsoleA
VirtualProtect
WritePrivateProfileStringA
FindNextFileA
FindFirstFileA
FindClose
SetFileAttributesA
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
SetWaitableTimer
CreateWaitableTimerA
lstrcpyn
Process32Next
Process32First
CreateToolhelp32Snapshot
WideCharToMultiByte
lstrlenW
GetTickCount
GetCurrentProcessId
FreeConsole
GetLocalTime
IsDebuggerPresent
Sleep
GetLogicalProcessorInformation
GetVersion
CreateEventA
OpenEventA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
CreateFileMappingA
OpenFileMappingA
CreateMutexA
GlobalMemoryStatusEx
GetProcAddress
VirtualFree
VirtualAlloc
SetConsoleTitleA
CloseHandle
LocalFree
LocalAlloc
OpenProcess
GetPrivateProfileStringA
GetCurrentProcess
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
RaiseException
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryA
InterlockedIncrement
InterlockedDecrement
GetTempPathA
GetLastError
GetVersionExA
GetSystemInfo
IsProcessorFeaturePresent
GetWindowsDirectoryA
MultiByteToWideChar
MulDiv
lstrcatA
lstrcpyA
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
gdi32
CreateFontA
TranslateCharsetInfo
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetObjectA
GetDIBits
DeleteDC
DeleteObject
GetDeviceCaps
advapi32
OpenProcessToken
LookupPrivilegeValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
user32
GetWindowTextLengthW
GetWindowTextW
FindWindowA
IsWindow
GetAsyncKeyState
FindWindowExA
MessageBoxTimeoutA
GetSystemMetrics
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetDC
GetDesktopWindow
GetWindowRect
ReleaseDC
CreateWindowStationA
MessageBoxA
MsgWaitForMultipleObjects
SendInput
GetParent
CallWindowProcA
CreateWindowExA
GetCursorPos
GetSysColor
LoadBitmapA
RegisterHotKey
ReleaseCapture
ScreenToClient
SendMessageA
SetCapture
UnregisterHotKey
SetLayeredWindowAttributes
SetWindowLongA
GetClassNameA
GetWindowTextA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
wsprintfA
ws2_32
closesocket
socket
inet_addr
htons
connect
send
recv
getsockname
ntohs
WSAAsyncSelect
select
WSACleanup
gethostbyname
inet_ntoa
WSAStartup
shlwapi
PathFileExistsA
shell32
DragAcceptFiles
SHGetSpecialFolderPathA
DragFinish
DragQueryFileA
comctl32
ImageList_DragLeave
ImageList_DragMove
ImageList_DragEnter
ImageList_EndDrag
ord17
ImageList_Destroy
ImageList_Create
ImageList_BeginDrag
ImageList_Add
ImageList_DragShowNolock
Sections
.text Size: 592KB - Virtual size: 591KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6.9MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ