Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 19:17
Behavioral task
behavioral1
Sample
c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42.dll
-
Size
39KB
-
MD5
306d01d26d82998b1d99404b0d0b6805
-
SHA1
f48ad671df396e033deee8bc8c8b197ae95c6398
-
SHA256
c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42
-
SHA512
f62806571ccf08560bbfdd28b156d968006df651a70eef1f1bc4c8a6b76189373c4c20a8605f2b17bc3e2b979325598d1afc06d8deb755b9f7197d1236086f19
-
SSDEEP
768:nVC7MZmIOUbW9aKan5G9YHyybcS+LS0whGfxzv7f:RZqU9LnZjMG0whE
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral1/memory/2788-1-0x0000000010000000-0x0000000010030000-memory.dmp family_blackmoon behavioral1/memory/2788-3-0x0000000010000000-0x0000000010030000-memory.dmp family_blackmoon behavioral1/memory/2788-0-0x0000000010000000-0x0000000010030000-memory.dmp family_blackmoon -
resource yara_rule behavioral1/memory/2788-2-0x00000000001C0000-0x00000000001CB000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1920 wrote to memory of 2788 1920 rundll32.exe 28 PID 1920 wrote to memory of 2788 1920 rundll32.exe 28 PID 1920 wrote to memory of 2788 1920 rundll32.exe 28 PID 1920 wrote to memory of 2788 1920 rundll32.exe 28 PID 1920 wrote to memory of 2788 1920 rundll32.exe 28 PID 1920 wrote to memory of 2788 1920 rundll32.exe 28 PID 1920 wrote to memory of 2788 1920 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42.dll,#12⤵PID:2788
-