Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 22:58
Behavioral task
behavioral1
Sample
6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe
Resource
win7-20240221-en
General
-
Target
6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe
-
Size
440KB
-
MD5
d5c59bea6aa23227033e38138885fe11
-
SHA1
7d759e7c38529e91905adedced3b50c71cace6af
-
SHA256
6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4
-
SHA512
f58c9cf643f23df82422f589405fb2534b586cb6d22fbb14201fb16d0356fc4b8dd93bcdce2cd6674ec07b6e3d68bef8ca80fd2b77f92904fa60c2b2a0a1cd1a
-
SSDEEP
6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAT:xgXQKSLpOCtV0R8xMSaAT
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Syslemhpgpw.exe family_blackmoon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe -
Deletes itself 1 IoCs
Processes:
Syslemhpgpw.exepid process 904 Syslemhpgpw.exe -
Executes dropped EXE 1 IoCs
Processes:
Syslemhpgpw.exepid process 904 Syslemhpgpw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exeSyslemhpgpw.exepid process 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe 904 Syslemhpgpw.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exedescription pid process target process PID 2456 wrote to memory of 904 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe Syslemhpgpw.exe PID 2456 wrote to memory of 904 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe Syslemhpgpw.exe PID 2456 wrote to memory of 904 2456 6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe Syslemhpgpw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe"C:\Users\Admin\AppData\Local\Temp\6c51affaebfd462bb1874140dbb82925e28c1fb1a01e1898f6589ba550b70ea4.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\Syslemhpgpw.exe"C:\Users\Admin\AppData\Local\Temp\Syslemhpgpw.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4320,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:81⤵PID:4420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
440KB
MD59e8fc5f34b48c84bbcdb4c9ba49747a7
SHA187e0d600069b1b973f60639e1d107f1a357e8412
SHA256f7a3b24d8d78e41b1636c3ed58148a8871c6537a5d69048134251b1086e3f7d5
SHA5127e3bbf309487fe1e5ea123084ce85e7efe2bfd5025676bec48aaaa25c82e97278fe4d07e573ac5bcc294013d0437224eb560785111ccfafaf8edbf5d4c1cdaa8
-
Filesize
102B
MD5a6792ef1175f12b6d58aa4a75103977d
SHA1edb10ec20b3be6a3f99b561031bdfa3797e14128
SHA256dad7bac1a417831992757964d570f20343837d856dd8d5e5cde6a84b37c58f2f
SHA51275d9877a0ce4924f5bbf347656ac48670e84e0db64e4d08ef50c329aa97198dd22054b5b5f6120cd4822a2052d379f878f5fb47cdd8bc9f6cd9d61da25fc01bf