Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
25/11/2023, 04:58
Behavioral task
behavioral1
Sample
ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe
Resource
win7-20231020-en
windows7-x64
8 signatures
150 seconds
General
-
Target
ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe
-
Size
1.4MB
-
MD5
740f5a2470924adf6f235521d5e84291
-
SHA1
2022bf39ee0205ac548e74a378ba17c0f62a8b54
-
SHA256
ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4
-
SHA512
71abf1aa6cc5a08fde97eaef537d83f321b12ec6f8ae69686848671ed31f5e75a1c0cfb92e656f0fc428e88c05ca0f6bd86e53b421fd38923f8cdc08db475cad
-
SSDEEP
24576:HJtykDzVdMYeIq3xDwj+A9Q3PZhTHetfW41MMTjZn73T6ofhXrc5266BH6cQqqs8:PyIzrderhvZlqxfhX+kacpAZI7xg
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/2204-7-0x0000000010000000-0x0000000010052000-memory.dmp family_blackmoon -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x002a000000014bc1-3.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe -
resource yara_rule behavioral1/memory/2204-0-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/files/0x002a000000014bc1-3.dat upx behavioral1/memory/2204-5-0x0000000010000000-0x0000000010052000-memory.dmp upx behavioral1/memory/2204-6-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-7-0x0000000010000000-0x0000000010052000-memory.dmp upx behavioral1/memory/2204-8-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-10-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-11-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-13-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-15-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-17-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-19-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-21-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-23-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-25-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-27-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-29-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-31-0x0000000000400000-0x0000000000AE6000-memory.dmp upx behavioral1/memory/2204-33-0x0000000000400000-0x0000000000AE6000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: 33 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe Token: SeIncBasePriorityPrivilege 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe 2204 ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe"C:\Users\Admin\AppData\Local\Temp\ec7c684c0fb0fa8d61f5304e0531ab82fa7ef356a00d808072d0d47c833eceb4.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2204
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5ed0c74815e4d0c37563d89c7af54f2cc
SHA1f12d4e876740769fe8c81fa421827140c8a0cf4e
SHA256f07eb8723995cf5c90bad1a3fa3bc6419dad3952f238413c9b62d1f8ef292945
SHA5120bccb938bca4f4546879119d81a2e7fe88552f87ab7e3cdfe7b70cd7bbcd847a607ff9e4423448e6bd87ffb901780041ad4fae1261ae7adbece53654935fc4ab