Behavioral task
behavioral1
Sample
dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d.exe
Resource
win10v2004-20240426-en
General
-
Target
dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d
-
Size
4.2MB
-
MD5
df6980e47c554e38faba047d8713dbb8
-
SHA1
3182f0a2bc99765dac3e52d2dd9dab6120ed16f0
-
SHA256
dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d
-
SHA512
3d239b5d572cac327787af1759ca76bc8f96da3c01021731246b60da98da4681017d9bd366ca1e4b803bd800e12ee190784db4d44c0d8076ca04ed0e4af6175d
-
SSDEEP
98304:MamlZr+XhCUf/7WIzUJ6HL//Wwxgy0Q0i5Xnhb/:5XhDf/7W9i3jbz5nh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon -
Processes:
resource yara_rule sample detect_ak_stuff -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d
Files
-
dc010de4391e4e2c878b1eebd73e4d1ab3aa684938910e0b59b0173ef016cf4d.exe windows:4 windows x86 arch:x86
58efb53b43cc5f673b204107d96104e1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenFileMappingA
GetVersion
RtlUnwind
GetCurrentProcess
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
IsBadWritePtr
RaiseException
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringW
TerminateProcess
FlushFileBuffers
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
lstrlenA
LocalFree
lstrcpyA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcatA
lstrcpynA
LocalAlloc
GlobalHandle
GlobalReAlloc
LocalReAlloc
GlobalFlags
GetProcessVersion
SetErrorMode
SetEndOfFile
GetTimeZoneInformation
ExitThread
HeapSize
UnhandledExceptionFilter
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetExitCodeThread
CreateFileMappingA
DeviceIoControl
InitializeCriticalSection
lstrcpyn
LeaveCriticalSection
EnterCriticalSection
GetSystemTime
InterlockedCompareExchange
OpenFileMappingW
MapViewOfFile
OpenEventA
SetEvent
UnmapViewOfFile
VirtualProtect
VirtualFree
VirtualAlloc
MoveFileA
GetVolumeInformationA
GetDriveTypeA
GetCurrentDirectoryA
CreateDirectoryA
GetLogicalDriveStringsA
SetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
GetTickCount
TerminateThread
GlobalFree
MultiByteToWideChar
GlobalAlloc
GlobalLock
GlobalUnlock
GetLastError
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
GetLocalTime
CreateFileA
GetSystemTimeAsFileTime
GetFileSize
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
GetComputerNameA
QueryPerformanceFrequency
QueryPerformanceCounter
CreateWaitableTimerA
SetWaitableTimer
GetCurrentProcessId
GetCurrentThreadId
GetWindowsDirectoryA
GetFileAttributesA
GetTempPathA
WideCharToMultiByte
CreateMutexA
CreateThread
ReleaseMutex
OutputDebugStringA
FindResourceA
SizeofResource
LoadResource
LockResource
EnumResourceNamesA
MulDiv
LCMapStringA
LoadLibraryA
FreeLibrary
GetModuleFileNameA
GetCommandLineA
DeleteFileA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CloseHandle
Sleep
GetProcAddress
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
SetStdHandle
OpenProcess
user32
GetSysColorBrush
LoadStringA
GetDCEx
LockWindowUpdate
GetWindowPlacement
IsDialogMessageA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
GetDesktopWindow
WindowFromPoint
SetMenuItemBitmaps
wsprintfW
SetCapture
EndPaint
BeginPaint
DrawTextA
FillRect
DrawIconEx
GetIconInfo
CreateIconFromResourceEx
CreateIconFromResource
SystemParametersInfoA
FrameRect
CallWindowProcA
InflateRect
GetWindowTextLengthA
GetWindowTextA
SetRectEmpty
CopyRect
DrawFrameControl
DrawTextW
DefWindowProcA
ReleaseCapture
OffsetRect
GetClassLongA
SetClassLongA
SetRect
PostThreadMessageA
DestroyIcon
AppendMenuW
EnableMenuItem
CheckMenuItem
GetMenuState
GetMenu
CreatePopupMenu
DestroyMenu
GetMenuItemCount
GetDlgCtrlID
UpdateWindow
IsWindowEnabled
SetFocus
SetWindowTextA
GetDlgItem
CallWindowProcW
IsMenu
TrackPopupMenu
DrawEdge
InvalidateRect
SetCursor
GetSysColor
SendMessageW
GetClassNameA
UnionRect
IsRectEmpty
GrayStringA
TabbedTextOutA
GetWindowDC
RegisterHotKey
KillTimer
SetTimer
GetWindow
SetParent
SetWindowLongW
SetWindowLongA
PostQuitMessage
PtInRect
GetWindowLongA
SetWindowTextW
EndDialog
IsWindowVisible
ShowWindow
DialogBoxIndirectParamW
MapWindowPoints
AdjustWindowRectEx
EqualRect
DeferWindowPos
CreateDialogIndirectParamW
DestroyWindow
RegisterWindowMessageW
CreateWindowExA
EnableWindow
GetAsyncKeyState
MsgWaitForMultipleObjects
FindWindowA
IsIconic
OpenIcon
GetForegroundWindow
GetActiveWindow
GetWindowThreadProcessId
AttachThreadInput
SetActiveWindow
SetForegroundWindow
GetParent
IsChild
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetSubMenu
SetPropA
UnhookWindowsHookEx
GetPropA
RemovePropA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
ScreenToClient
SetWindowPos
GetClientRect
ClientToScreen
PostMessageA
SendMessageA
CreateWindowExW
IsWindow
GetWindowRect
MoveWindow
GetMessageW
DispatchMessageW
DefWindowProcW
GetClassInfoExW
RegisterClassExW
GetDC
ReleaseDC
LoadIconA
LoadImageA
LoadCursorA
AppendMenuA
IntersectRect
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetCursorPos
GetSystemMetrics
wsprintfA
MessageBoxA
GetMenuItemID
UnregisterClassA
gdi32
GetStockObject
GetTextMetricsA
CreateSolidBrush
GetObjectW
CreatePatternBrush
CreateRectRgn
GetObjectA
PtVisible
RectVisible
TextOutA
Escape
SetRectRgn
CombineRgn
CreatePen
Rectangle
SetTextColor
GetObjectType
CreateCompatibleDC
SelectObject
DeleteDC
GetDeviceCaps
DeleteObject
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
CreateFontIndirectA
RestoreDC
SaveDC
CreateRectRgnIndirect
PatBlt
GetClipBox
GetDCOrgEx
CreateBitmap
GdiFlush
CreateFontA
CreateEllipticRgn
MoveToEx
LineTo
SetBkColor
ExtTextOutA
BitBlt
CreateCompatibleBitmap
SetBkMode
CreateDIBSection
advapi32
StartServiceA
QueryServiceStatus
CloseServiceHandle
CreateServiceA
OpenServiceA
OpenSCManagerA
DeleteService
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
ControlService
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
oleaut32
VarUdateFromDate
VariantTimeToSystemTime
shlwapi
PathCanonicalizeA
PathFindExtensionA
SHGetValueA
SHSetValueA
PathGetDriveNumberA
PathAddBackslashA
PathRenameExtensionA
PathAddExtensionA
PathAppendA
PathRemoveFileSpecA
PathFindFileNameA
PathRemoveExtensionA
PathRemoveBackslashA
PathFileExistsA
StrToIntExA
SHDeleteKeyA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
shell32
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
DragFinish
DragQueryFileA
Shell_NotifyIconW
ShellExecuteA
DragAcceptFiles
SHGetFileInfoA
comctl32
InitCommonControlsEx
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Add
ImageList_Create
_TrackMouseEvent
ImageList_GetIcon
ord17
ole32
CoInitialize
CreateStreamOnHGlobal
CLSIDFromString
msimg32
AlphaBlend
wininet
InternetTimeFromSystemTime
gdiplus
GdipDrawArcI
GdipDrawString
GdipFree
GdipDeletePath
GdipDrawPath
GdipFillPath
GdipSetSmoothingMode
GdipCreateFromHDC
GdiplusStartup
GdipMeasureString
GdipCreateFromHWND
GdipAlloc
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromHICON
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipGetImageHeight
GdipDeleteGraphics
GdipFillRectangleI
GdipCreateTexture
GdipDrawImageRectRectI
GdipCreateHICONFromBitmap
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipAddPathEllipseI
GdipCreateLineBrushI
GdipAddPathRectangleI
GdipCreatePath
GdipDeletePen
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteFont
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipGetGenericFontFamilySansSerif
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipClosePathFigure
GdipAddPathArcI
GdipResetClip
GdipFillEllipseI
GdipSetClipRectI
GdipAddPathArc
GdipFillPolygonI
GdipDrawLineI
GdipSetImageAttributesColorMatrix
GdipCreateImageAttributes
GdipSetClipPath
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipSetPathGradientCenterPointI
GdipCreatePathGradientFromPath
GdipAddPathPieI
GdipDrawEllipseI
GdipSetClipHrgn
GdipGetImageWidth
winhttp
WinHttpReadData
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpSetCredentials
WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpOpen
WinHttpConnect
WinHttpSetTimeouts
setupapi
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
Sections
ULUDLRYJ Size: 812KB - Virtual size: 808KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ULUDLRYJ Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ULUDLRYJ Size: 148KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ULUDLRYJ Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ULUDLRYJ Size: 144KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE