Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2024 19:32
Static task
static1
Behavioral task
behavioral1
Sample
dc6f92f4fb7168a6df8aeef784e0ac7b.dll
Resource
win7-20240221-en
General
-
Target
dc6f92f4fb7168a6df8aeef784e0ac7b.dll
-
Size
367KB
-
MD5
dc6f92f4fb7168a6df8aeef784e0ac7b
-
SHA1
d9b6cd710a72fa7aa01c7738770013919cfb4b7b
-
SHA256
65fb54bf9cbf4867dc060cfea4f5b7955ac5a8ee24f7a849a7b76b1661f62918
-
SHA512
6d0f5641d4b7860406c6fc6b97838b98feb24aeba2a2c6e13523c1c29812d07ec741f4b4a2cbd750e46a611d32aaf86611b400e885a87daf38a604b189cfaa3c
-
SSDEEP
6144:gL+2S+vQmN3BFaXi51rw4t2IDuahWM3Qi9Mjt0jYWNMoS:w+2S+vzRR2+uahZ59MWsWNMoS
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/4476-11-0x0000000000400000-0x00000000004C2000-memory.dmp family_blackmoon behavioral2/memory/4776-17-0x0000000010000000-0x00000000100B2000-memory.dmp family_blackmoon -
Executes dropped EXE 2 IoCs
pid Process 4476 0031-Y.exe 2480 ad10549.exe -
Loads dropped DLL 1 IoCs
pid Process 3732 regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11F09AFE-75AD-4E52-AB43-E09E9351CE17} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\ = "AdPopup" regsvr32.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\PushWare\Uninst.exe ad10549.exe File created C:\Program Files (x86)\Common Files\PushWare\cpush.dll ad10549.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1104 4776 WerFault.exe 87 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NexoAdPopup.AOLogic\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\PushWare\\cpush.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NewCosoMediumPop.PopCoso.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Common Files\\PushWare\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\ = "CAdLogic Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\TypeLib\ = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\PushWare\\cpush.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\ = "IToolbarDetector" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NewCosoMediumPop.PopCoso.1\CLSID\ = "{CDE9EB54-A08E-4570-B748-13F5DDB5781C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\PushWare\\cpush.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\PushWare\\cpush.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NexoAdPopup.AOLogic.1\CLSID\ = "{11F09AFE-75AD-4E52-AB43-E09E9351CE17}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\ProgID\ = "NexoAdPopup.AOLogic.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}\ = "IPopupBlock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\ProgID\ = "NewCosoMediumPop.PopCoso.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NexoAdPopup.AOLogic.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\VersionIndependentProgID\ = "NexoAdPopup.AOLogic" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\TypeLib\ = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NewCosoMediumPop.PopCoso.1\ = "CPopupBlock Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NewCosoMediumPop.PopCoso\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\ = "IAdLogic" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\TypeLib\ = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\AppID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}\TypeLib\ = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NexoAdPopup.AOLogic.1\ = "CAdLogic Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17}\TypeLib\ = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F09AFE-75AD-4E52-AB43-E09E9351CE17} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector\CLSID\ = "{34A12A06-48C0-420D-8F11-73552EE9631A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NewCosoMediumPop.PopCoso\CurVer\ = "NewCosoMediumPop.PopCoso.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}\1.0\0\win32\ = "C:\\Program Files (x86)\\Common Files\\PushWare\\cpush.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}\TypeLib\ = "{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4476 0031-Y.exe 4476 0031-Y.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4776 4940 rundll32.exe 87 PID 4940 wrote to memory of 4776 4940 rundll32.exe 87 PID 4940 wrote to memory of 4776 4940 rundll32.exe 87 PID 4776 wrote to memory of 4476 4776 rundll32.exe 91 PID 4776 wrote to memory of 4476 4776 rundll32.exe 91 PID 4776 wrote to memory of 4476 4776 rundll32.exe 91 PID 4776 wrote to memory of 2480 4776 rundll32.exe 92 PID 4776 wrote to memory of 2480 4776 rundll32.exe 92 PID 4776 wrote to memory of 2480 4776 rundll32.exe 92 PID 4476 wrote to memory of 3496 4476 0031-Y.exe 57 PID 4476 wrote to memory of 3496 4476 0031-Y.exe 57 PID 2480 wrote to memory of 3732 2480 ad10549.exe 95 PID 2480 wrote to memory of 3732 2480 ad10549.exe 95 PID 2480 wrote to memory of 3732 2480 ad10549.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc6f92f4fb7168a6df8aeef784e0ac7b.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc6f92f4fb7168a6df8aeef784e0ac7b.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\safe\0031-Y.exeC:\Users\Admin\AppData\Local\Temp\safe\0031-Y.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\safe\ad10549.exeC:\Users\Admin\AppData\Local\Temp\safe\ad10549.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\PushWare\cpush.dll"5⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 7484⤵
- Program crash
PID:1104
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4776 -ip 47761⤵PID:1420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD55b016a5c9b3c3fbc1ba1adb5cc108255
SHA1ae65a866f2f117dbeea2ca7cb5e59c4198224744
SHA25652a0c050154ef03b871e4227eef77ea6ad45829916154f4c410dc6c0aff4cca0
SHA512473d99519c2b3bfc1d3da6da2120871fc3729debf183640565e624dad04b96928f9061ac724a81f4e3723e35d04a95a3d8b6ac6efbec082da763cc20efac5cca
-
Filesize
149KB
MD5de9cc8098b94bd145a15c5f82b71d0bc
SHA18f3040f0dade2af1a4ad5522a5f4a666b94e34b7
SHA25615d959391d29169376ae7bc04c717545198f6ea72dd95e4c4c2050289a502cf9
SHA512761829d9cc753d2888a2a15efe1844e93a4c55972956ccf8666cd161b948c0c6ba3ffa103bbf623d4a179046fd1ec98cfe0ff7708be3c1f63442ddef1251e6f2
-
Filesize
138KB
MD518bcc17362e3c0c971a6a3ca9a2602ff
SHA10b3ae00b4f2879085f037feccb91a5c6c63aba51
SHA2563a474ff67f64afb6acf747b8b619396276fdd085d846b2f5d4d528f9c1c26a21
SHA5128b57958d77a8a3f7a5c5f8c68f057c370c74d956fa3c67013207ecea5b0f84e7c1131275491e66c8cc10411f485e6ad6c5a70a5f1d0cdd269e468ecaf8934b0c