Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 13:14
Behavioral task
behavioral1
Sample
9c6a6ef3837daf5ad8d9b5212eccb65f.dll
Resource
win7-20231215-en
7 signatures
150 seconds
General
-
Target
9c6a6ef3837daf5ad8d9b5212eccb65f.dll
-
Size
2.1MB
-
MD5
9c6a6ef3837daf5ad8d9b5212eccb65f
-
SHA1
01407dcfe19f0d900a9f38cf85a23a5230016935
-
SHA256
24f059fa22c759504c1183e533f1be75b0cd96f5ccddcccaa59b306974da221b
-
SHA512
6a9da37ab59ed84cabb4acd9bfc3cee111ec2a288945e2679ed7b7d0d1a58770d2a06664d2104bfca31989b92c95c589b37430089d5b06caacc844916ae7ca78
-
SSDEEP
49152:vQwi6N4RMIL9LVuHZVMEb+/0bd7Gdc3rxtwSNUFIKDjw:ris46IL9LVu3tbZGOwSWFI
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral1/memory/2088-7-0x00000000006C0000-0x0000000000747000-memory.dmp family_blackmoon behavioral1/memory/2088-13-0x00000000033A0000-0x0000000003428000-memory.dmp family_blackmoon behavioral1/memory/2088-28-0x0000000003CF0000-0x0000000003D55000-memory.dmp family_blackmoon -
Blocklisted process makes network request 3 IoCs
flow pid Process 2 2088 rundll32.exe 10 2088 rundll32.exe 11 2088 rundll32.exe -
resource yara_rule behavioral1/memory/2088-0-0x0000000010000000-0x000000001007F000-memory.dmp vmprotect behavioral1/memory/2088-24-0x0000000010000000-0x000000001007F000-memory.dmp vmprotect behavioral1/memory/2088-26-0x0000000010000000-0x000000001007F000-memory.dmp vmprotect behavioral1/memory/2088-40-0x0000000010000000-0x000000001007F000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2088 rundll32.exe 2088 rundll32.exe 2088 rundll32.exe 2088 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2088 rundll32.exe Token: SeTcbPrivilege 2088 rundll32.exe Token: SeLoadDriverPrivilege 2088 rundll32.exe Token: SeDebugPrivilege 2088 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2088 2080 rundll32.exe 28 PID 2080 wrote to memory of 2088 2080 rundll32.exe 28 PID 2080 wrote to memory of 2088 2080 rundll32.exe 28 PID 2080 wrote to memory of 2088 2080 rundll32.exe 28 PID 2080 wrote to memory of 2088 2080 rundll32.exe 28 PID 2080 wrote to memory of 2088 2080 rundll32.exe 28 PID 2080 wrote to memory of 2088 2080 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c6a6ef3837daf5ad8d9b5212eccb65f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c6a6ef3837daf5ad8d9b5212eccb65f.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088
-