Behavioral task
behavioral1
Sample
75e5711e068dfdaf57dbf3e59849b9a42df949cfbbffd3e96bb9ed69b255365e.exe
Resource
win7-20230831-en
General
-
Target
75e5711e068dfdaf57dbf3e59849b9a42df949cfbbffd3e96bb9ed69b255365e
-
Size
126KB
-
MD5
9527cab43feb345bec646dc6b064f88a
-
SHA1
e18829e4d0e8c31e61729dbfd4201db9368e32f4
-
SHA256
75e5711e068dfdaf57dbf3e59849b9a42df949cfbbffd3e96bb9ed69b255365e
-
SHA512
56d0cf78dde241bd1baba9ef1d9a9b8dcdb6cea43f944761a1a983106c154ef648eb0fd15815eb974238dfa7259dff1cb3af10ab139c681583b3e296ab5c0c43
-
SSDEEP
1536:f+R/VI9gQd7XvR3lYqTP09w5ipbKYPgz8+WVxodT44qe3q1Ycvvr5kKEY7EFnBUB:fu/VB4V5ipbhPgz8FyqewTvDyRxBUB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75e5711e068dfdaf57dbf3e59849b9a42df949cfbbffd3e96bb9ed69b255365e
Files
-
75e5711e068dfdaf57dbf3e59849b9a42df949cfbbffd3e96bb9ed69b255365e.exe windows:4 windows x86
2120f8144402bf94993c0f84e9bea502
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
VirtualQueryEx
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
lstrcpynA
GetProcessHeap
GetModuleHandleA
GetLastError
lstrlenA
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetTickCount
GetCommandLineA
FreeLibrary
LCMapStringA
GetCurrentProcess
ExitProcess
RtlZeroMemory
GetCurrentThread
GetEnvironmentVariableW
GetModuleFileNameW
ProcessIdToSessionId
CopyFileA
RtlMoveMemory
GetCommandLineW
WideCharToMultiByte
lstrcpyn
MultiByteToWideChar
ExpandEnvironmentStringsW
WTSGetActiveConsoleSessionId
HeapAlloc
user32
MessageBoxA
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
wsprintfA
advapi32
SetTokenInformation
OpenProcessToken
StartServiceA
ChangeServiceConfig2A
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
DuplicateTokenEx
AdjustTokenPrivileges
CreateProcessAsUserA
LookupPrivilegeValueA
shell32
ShellExecuteA
CommandLineToArgvW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
msvcrt
__CxxFrameHandler
calloc
free
malloc
sprintf
atoi
_ftol
rand
modf
floor
strrchr
strchr
realloc
??3@YAXPAX@Z
memmove
strncmp
ws2_32
WSACleanup
gethostbyname
WSAStartup
inet_ntoa
Sections
.text Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE