Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 13:14
Behavioral task
behavioral1
Sample
9c6a6ef3837daf5ad8d9b5212eccb65f.dll
Resource
win7-20231215-en
7 signatures
150 seconds
General
-
Target
9c6a6ef3837daf5ad8d9b5212eccb65f.dll
-
Size
2.1MB
-
MD5
9c6a6ef3837daf5ad8d9b5212eccb65f
-
SHA1
01407dcfe19f0d900a9f38cf85a23a5230016935
-
SHA256
24f059fa22c759504c1183e533f1be75b0cd96f5ccddcccaa59b306974da221b
-
SHA512
6a9da37ab59ed84cabb4acd9bfc3cee111ec2a288945e2679ed7b7d0d1a58770d2a06664d2104bfca31989b92c95c589b37430089d5b06caacc844916ae7ca78
-
SSDEEP
49152:vQwi6N4RMIL9LVuHZVMEb+/0bd7Gdc3rxtwSNUFIKDjw:ris46IL9LVu3tbZGOwSWFI
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral2/memory/1112-7-0x00000000027E0000-0x0000000002867000-memory.dmp family_blackmoon behavioral2/memory/1112-28-0x0000000004360000-0x00000000043C5000-memory.dmp family_blackmoon behavioral2/memory/1112-13-0x0000000005160000-0x00000000051E8000-memory.dmp family_blackmoon -
Blocklisted process makes network request 5 IoCs
flow pid Process 4 1112 rundll32.exe 13 1112 rundll32.exe 17 1112 rundll32.exe 50 1112 rundll32.exe 52 1112 rundll32.exe -
resource yara_rule behavioral2/memory/1112-0-0x0000000010000000-0x000000001007F000-memory.dmp vmprotect behavioral2/memory/1112-21-0x0000000010000000-0x000000001007F000-memory.dmp vmprotect behavioral2/memory/1112-22-0x0000000010000000-0x000000001007F000-memory.dmp vmprotect behavioral2/memory/1112-44-0x0000000010000000-0x000000001007F000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1112 rundll32.exe Token: SeTcbPrivilege 1112 rundll32.exe Token: SeLoadDriverPrivilege 1112 rundll32.exe Token: SeDebugPrivilege 1112 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3956 wrote to memory of 1112 3956 rundll32.exe 17 PID 3956 wrote to memory of 1112 3956 rundll32.exe 17 PID 3956 wrote to memory of 1112 3956 rundll32.exe 17
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c6a6ef3837daf5ad8d9b5212eccb65f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c6a6ef3837daf5ad8d9b5212eccb65f.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112
-