hook
Behavioral task
behavioral1
Sample
NEAS.51000bb80d9df577fb062edb68a42fc0_JC.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.51000bb80d9df577fb062edb68a42fc0_JC.dll
Resource
win10v2004-20231023-en
General
-
Target
NEAS.51000bb80d9df577fb062edb68a42fc0_JC.exe
-
Size
300KB
-
MD5
51000bb80d9df577fb062edb68a42fc0
-
SHA1
202064f9a6933971c2af9934e6fc1abc58af90ba
-
SHA256
750be933a67ab7ad393596a1251df56923202ab6e7b16925ca3f07f0f2444a41
-
SHA512
1515fb1aed51935bd8b68e3e78737f97c4955612d746d73fe98500510e6e7c4b1c6f5f46a437388cb99e7ed8216860804bd2d1c6fb971677aef220c3acaa3821
-
SSDEEP
3072:f0cDEGXvQCSp0egK54T8w5uXohD2tEhX:LEGCgK568w5iotR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.51000bb80d9df577fb062edb68a42fc0_JC.exe
Files
-
NEAS.51000bb80d9df577fb062edb68a42fc0_JC.exe.dll windows:4 windows x86
bb0b116cc7b9ca04602c08973f135efa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtectEx
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
GetModuleFileNameA
GetPrivateProfileStringA
GetVersionExA
VirtualQueryEx
FreeLibrary
LoadLibraryA
LCMapStringA
IsBadReadPtr
GetCurrentProcessId
OpenProcess
CloseHandle
GetCurrentProcess
GetCommandLineA
GetProcAddress
FlushInstructionCache
VirtualProtect
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
VirtualQuery
VirtualAlloc
GetSystemInfo
VirtualFree
ResumeThread
SetThreadPriority
GetThreadPriority
GetCurrentThread
GetCurrentThreadId
Sleep
GetThreadContext
SuspendThread
GetVersion
TerminateProcess
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
WriteFile
RtlUnwind
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
SetFilePointer
InterlockedDecrement
InterlockedIncrement
SetStdHandle
LCMapStringW
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
user32
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
PeekMessageA
Exports
Exports
Sections
.text Size: 104KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 176KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ