Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d2fe840c45bc4f60cba85e7e1709c3e993e9faed230f88e785988aacae68c3d3.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
d2fe840c45bc4f60cba85e7e1709c3e993e9faed230f88e785988aacae68c3d3.dll
-
Size
15.1MB
-
MD5
ca455757a490342d08ddd0636282d1db
-
SHA1
bfc05e1baa642475b06048aeb09f4e90cd709e87
-
SHA256
d2fe840c45bc4f60cba85e7e1709c3e993e9faed230f88e785988aacae68c3d3
-
SHA512
954b9925669ce2fe44c65ee589a45b47588496d4a62facf583bb0a952ee9c44686f754a1df773713a12c8e7f1dcebef749b895c6cf383006518118ae57f2989f
-
SSDEEP
393216:aiIPTObyuJIOmTnMTW6vBfK+DlV3y7Prqt:aLPWGOpS+X36PWt
Malware Config
Signatures
-
Detect Blackmoon payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/4828-2-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-7-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-11-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-15-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-20-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-27-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-23-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-30-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-32-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-39-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-40-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon behavioral2/memory/4828-41-0x0000000010000000-0x00000000120DA000-memory.dmp family_blackmoon -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3188 4828 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 8 wrote to memory of 4828 8 rundll32.exe rundll32.exe PID 8 wrote to memory of 4828 8 rundll32.exe rundll32.exe PID 8 wrote to memory of 4828 8 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2fe840c45bc4f60cba85e7e1709c3e993e9faed230f88e785988aacae68c3d3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2fe840c45bc4f60cba85e7e1709c3e993e9faed230f88e785988aacae68c3d3.dll,#12⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6323⤵
- Program crash
PID:3188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4828 -ip 48281⤵PID:1252