Behavioral task
behavioral1
Sample
c9d16bef43e551a8b97fc1e11990b60f0d3e74a81d48038a2a1455d165c879d2.exe
Resource
win7-20240319-en
General
-
Target
c9d16bef43e551a8b97fc1e11990b60f0d3e74a81d48038a2a1455d165c879d2.exe
-
Size
113KB
-
MD5
ca51cdf8afc584dbfc9f855acfaacbc4
-
SHA1
77236b5f70ccc7a3ace5fad56fc2ca69f39747af
-
SHA256
c9d16bef43e551a8b97fc1e11990b60f0d3e74a81d48038a2a1455d165c879d2
-
SHA512
f36b36227d63c3f429e1f0a156c1dc91b3a59f5ef07737bc126878134ebde0b6fbf8661e66c9d8a8927962422513110a9e508c3259a5a5fd079c21ae0a998ab1
-
SSDEEP
1536:bViMsvI+AQX1OdBaKpVllHG/fdt+fV3JbB5OPnDE5+QDJ4rX27qnrf:bav9OdPx8wJ4rm7qL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9d16bef43e551a8b97fc1e11990b60f0d3e74a81d48038a2a1455d165c879d2.exe
Files
-
c9d16bef43e551a8b97fc1e11990b60f0d3e74a81d48038a2a1455d165c879d2.exe.exe windows:4 windows x86 arch:x86
e5ac0f9205c73a7dd3d8c67873453d3c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlMoveMemory
GetComputerNameA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
CreateThread
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
IsBadReadPtr
CloseHandle
ReadFile
GetFileSize
CreateFileA
WriteFile
lstrcpynA
CreateProcessA
GetStartupInfoA
DeleteFileA
GetTickCount
Sleep
FindClose
FindNextFileA
RemoveDirectoryA
FindFirstFileA
SetFileAttributesA
GetUserDefaultLCID
FreeLibrary
LoadLibraryA
LCMapStringA
CreateEventA
OpenEventA
MoveFileA
CreateDirectoryA
GetTempPathA
GetCommandLineA
GetModuleFileNameA
WaitForSingleObject
ExitProcess
user32
wsprintfA
TranslateMessage
GetMessageA
PeekMessageA
GetDC
DispatchMessageA
MessageBoxA
GetDesktopWindow
ReleaseDC
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CreateProcessAsUserA
wininet
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
ws2_32
ntohs
inet_addr
bind
listen
WSACleanup
socket
htons
accept
recv
send
WSASocketA
WSAStartup
closesocket
gdi32
GetDeviceCaps
ole32
CoInitialize
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
shell32
SHGetPathFromIDListA
SHGetSpecialFolderLocation
msvcrt
malloc
free
modf
memmove
_ftol
atoi
strchr
strncpy
_CIfmod
floor
strrchr
__CxxFrameHandler
_strnicmp
rand
srand
tolower
??2@YAPAXI@Z
sprintf
??3@YAXPAX@Z
strncmp
shlwapi
PathFileExistsA
oleaut32
VariantClear
SysAllocString
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetLBound
VariantChangeType
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantInit
SafeArrayDestroy
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE