Behavioral task
behavioral1
Sample
6853fd152268b8a47e7a58492e2eab0e42234c0c75ff01896f151d9525cfbf07.exe
Resource
win7-20230831-en
General
-
Target
6853fd152268b8a47e7a58492e2eab0e42234c0c75ff01896f151d9525cfbf07
-
Size
402KB
-
MD5
20464f8d2ce113b53c7e8c24ebc08e99
-
SHA1
13eafc58e9a8ca71566680c9712c830b05f5df2b
-
SHA256
6853fd152268b8a47e7a58492e2eab0e42234c0c75ff01896f151d9525cfbf07
-
SHA512
8275a2321b46fd9b092dcc9185c6a6649d64b7fd2e946185fa88011ff00881202ebae5f6e23497f629e71fca19dd1f59451e95489c5db5efca2b5bcd250ac93e
-
SSDEEP
3072:RgryxaM4CHbdtXBcbeIyqewTvDyRxzUB5s0l1oU7jnSGlFpsI:RgryxabcvXSb/tpyE5s0lnFpsI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6853fd152268b8a47e7a58492e2eab0e42234c0c75ff01896f151d9525cfbf07
Files
-
6853fd152268b8a47e7a58492e2eab0e42234c0c75ff01896f151d9525cfbf07.exe windows:4 windows x86
9850679eb6ea1aee7c456d24f92e8067
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
VirtualQueryEx
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
lstrcpynA
CreateThread
GetProcessHeap
GetModuleHandleA
GetLastError
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetTickCount
GetCommandLineA
FreeLibrary
LCMapStringA
GetCurrentProcess
lstrcpyn
RtlZeroMemory
lstrlenA
GetCurrentThread
GetEnvironmentVariableW
ProcessIdToSessionId
GetModuleFileNameW
CopyFileA
RtlMoveMemory
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsW
WTSGetActiveConsoleSessionId
ExitProcess
user32
MessageBoxA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
MsgWaitForMultipleObjects
wsprintfA
advapi32
SetTokenInformation
OpenProcessToken
StartServiceA
ChangeServiceConfig2A
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
DuplicateTokenEx
AdjustTokenPrivileges
CreateProcessAsUserA
LookupPrivilegeValueA
shell32
ShellExecuteA
CommandLineToArgvW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
msvcrt
calloc
sprintf
atoi
_ftol
rand
modf
floor
strrchr
strchr
free
realloc
malloc
strstr
ws2_32
gethostbyname
WSACleanup
inet_ntoa
WSAStartup
oleaut32
VariantTimeToSystemTime
Sections
.text Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 282KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE