TenNetbarProtectBase
Behavioral task
behavioral1
Sample
fb629e5b76c8ee09f202bb60a0dfcde5ef0a1cbf59fdd101fcf46098859c861d.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fb629e5b76c8ee09f202bb60a0dfcde5ef0a1cbf59fdd101fcf46098859c861d.dll
Resource
win10v2004-20230915-en
General
-
Target
fb629e5b76c8ee09f202bb60a0dfcde5ef0a1cbf59fdd101fcf46098859c861d
-
Size
6.8MB
-
MD5
fe701f565c09640203e605ccf910650f
-
SHA1
93d80227184597b03766d218a7b959e404fe982c
-
SHA256
fb629e5b76c8ee09f202bb60a0dfcde5ef0a1cbf59fdd101fcf46098859c861d
-
SHA512
c01708615032208786616af0d5bb853bdc98220f92e23447fd6c41f108e15442bdf2bb5f8234f6748b3f691e8fd7a6f3e3130df259d7b456f1a858f8b6547777
-
SSDEEP
196608:eOfHnq8W5CNoI2jTRU1/tzH+OoBFyYz/R:tvAIgtUjT+OEF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb629e5b76c8ee09f202bb60a0dfcde5ef0a1cbf59fdd101fcf46098859c861d
Files
-
fb629e5b76c8ee09f202bb60a0dfcde5ef0a1cbf59fdd101fcf46098859c861d.dll windows:6 windows x86
27f949f0c7a322fc2bbb4245dc9bf603
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
LocalFree
GetCommandLineW
GetModuleFileNameA
CloseHandle
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetLocalTime
ReadFile
GetFileSize
GetProcessHeap
DeleteFileA
GetPrivateProfileStringA
WriteFile
WritePrivateProfileStringA
GetTickCount
GetCommandLineA
GetProcAddress
LoadLibraryA
LCMapStringA
FreeLibrary
TerminateProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
WideCharToMultiByte
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
CreateFileA
CreateThread
user32
wsprintfA
MsgWaitForMultipleObjects
CallWindowProcA
GetAsyncKeyState
SetTimer
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
MessageBoxA
shell32
CommandLineToArgvW
SHGetSpecialFolderPathA
msvcrt
modf
_CIfmod
atoi
_ftol
??2@YAPAXI@Z
_atoi64
free
malloc
floor
atof
srand
rand
strrchr
strchr
sprintf
realloc
strncmp
__CxxFrameHandler
memmove
??3@YAXPAX@Z
Exports
Exports
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6.7MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ