Behavioral task
behavioral1
Sample
a8bcfd5e5b43db8214a9ea482b172479415e6a32dc7861087e3dfb15b1e73ef9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a8bcfd5e5b43db8214a9ea482b172479415e6a32dc7861087e3dfb15b1e73ef9.exe
Resource
win10v2004-20240226-en
General
-
Target
c8dbc5edb975be168eccfa148c702a2e.bin
-
Size
95KB
-
MD5
96f0939fc44f3973eaaff2207e92d703
-
SHA1
8443f957bd9efe759138bfa4e3e672927157ee2e
-
SHA256
aa514f754f98de1813799b2e77bd0f868a2aa967e2e776f1c6e672c156581445
-
SHA512
d5f41f6f559a578587765307c4d7218ea921440083463774391766503624540da2777a2e87695e8ead40ad269cd9ea5196d80a797eda9183bb2d71f7965c3f2d
-
SSDEEP
1536:nuPbimG+R40I30pkQOvNea38m4tU8HbYzKdyesB2MUzKY37Lsi6pfGF8J2gqp:QG+mGkQsZotU8Hb8C8IrNHMJ2l
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/a8bcfd5e5b43db8214a9ea482b172479415e6a32dc7861087e3dfb15b1e73ef9.exe family_blackmoon -
resource yara_rule static1/unpack001/a8bcfd5e5b43db8214a9ea482b172479415e6a32dc7861087e3dfb15b1e73ef9.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/a8bcfd5e5b43db8214a9ea482b172479415e6a32dc7861087e3dfb15b1e73ef9.exe
Files
-
c8dbc5edb975be168eccfa148c702a2e.bin.zip
Password: infected
-
a8bcfd5e5b43db8214a9ea482b172479415e6a32dc7861087e3dfb15b1e73ef9.exe.exe windows:4 windows x86 arch:x86
Password: infected
80b69be2bc873884492028ff7ce272ad
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegOpenKeyA
LookupPrivilegeValueA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyA
comctl32
InitCommonControls
InitCommonControls
gdi32
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
GetStockObject
DeleteObject
DeleteDC
SelectObject
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
kernel32
lstrcmp
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
LocalFree
FlushFileBuffers
lstrcpyn
GetFullPathNameA
LocalAlloc
InitializeCriticalSection
TlsAlloc
lstrcmpi
GlobalHandle
TlsFree
LeaveCriticalSection
GlobalReAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
WritePrivateProfileStringA
GetCurrentDirectoryA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
GetCPInfo
GetOEMCP
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
GetCurrentThread
GetCurrentThreadId
GetVersion
GetTimeZoneInformation
lstrcat
SetLastError
GlobalAlloc
lstrcpy
Sleep
TerminateProcess
GetDriveTypeA
GetCurrentProcessId
SetFilePointer
GlobalLock
GlobalUnlock
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
GetLastError
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
lstrlen
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
GetTickCount
GetFileSize
ReadFile
CreateFileA
WriteFile
CloseHandle
SetFileAttributesA
CopyFileA
CreateDirectoryA
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
lstrcpyn
SetWaitableTimer
CreateWaitableTimerA
CreateThread
SetProcessWorkingSetSize
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateEventA
OpenEventA
GetCurrentProcess
OpenProcess
CloseHandle
SetPriorityClass
LoadLibraryA
ExitProcess
GetProcAddress
VirtualProtect
shell32
SHChangeNotify
SHGetSpecialFolderPathA
ShellExecuteA
ShellExecuteA
user32
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
GetMenuItemCount
SetWindowTextA
GetDlgCtrlID
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
ClientToScreen
IsIconic
GetWindowPlacement
SetFocus
LoadIconA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
SetCursor
PostMessageA
PostQuitMessage
GetWindow
PtInRect
GetWindowLongA
SetWindowLongA
GetDlgItem
SystemParametersInfoA
SendMessageA
GetWindowRect
GetSystemMetrics
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
GetParent
EnableWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
SetWindowPos
SetForegroundWindow
ShowWindow
GetClassNameA
GetWindowTextA
GetWindowThreadProcessId
IsWindowVisible
GetCursorPos
UnregisterClassA
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
OpenPrinterA
combase
CoCreateInstance
CoCreateInstance
Sections
UPX0 Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE