Analysis
- max time kernel
148s - max time network
122s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
20/05/2024, 02:59
Behavioral task
behavioral1
Sample
9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
General
- Target 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe
- Size 436KB
- Sample240520-dgrppage93
- SHA256 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1
- MD5 b252b0ffbbf0f4acc441dc35c4edf4e0
- SHA1 a6e31a9ef7fa64c2ba6bc2e16b350ca15c7edeb3
- SHA512 f9fa5a3183cea04704d718189fb62a75f0a60b5ae6a777cc4284b7f49680d185e82237b2978ee29a5102eecc498cf2a2dc28b7a8367b1b66b4c583abd14536e4
- SSDEEP 6144:dGdR+Yk/N8duBmG6t+UnRsRCQ/OJZOg7q:doR+Y4NSG6oUnRsdOJZOg7q
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/files/0x000a000000016c04-7.dat family_blackmoon - Deletes itself 1 IoCs
pid Process 2620 Syslemtcvcq.exe - Executes dropped EXE 1 IoCs
pid Process 2620 Syslemtcvcq.exe - Loads dropped DLL 2 IoCs
pid Process 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe 2620 Syslemtcvcq.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2620 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 29 PID 1788 wrote to memory of 2620 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 29 PID 1788 wrote to memory of 2620 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 29 PID 1788 wrote to memory of 2620 1788 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe"C:\Users\Admin\AppData\Local\Temp\9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\Syslemtcvcq.exe"C:\Users\Admin\AppData\Local\Temp\Syslemtcvcq.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\lpath.ini
- Size 102B
- SHA256 74d907233bde96a1e46200df5523237ad539d13a31a27c6d89142307f7330dac
- MD5 f19c1e40efab8c8951d1301873e485d7
- SHA1 cf81c43ff9be312f21d51c760c59e34c8c1284d6
- SHA512 48ca0ca522710ef52228e6af14a7fc25aa79c7e8af789f900e51699506be26e878cf99b7d848864df4fc1d0a82ebe93396026ed5fb8919048e096274633c8975
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\Syslemtcvcq.exe
- Size 436KB
- SHA256 2613c114ce23b2918478a8f1cfde9bf89cec4ab938274cad39a909eb491070a4
- MD5 187f10af2b9664edab965cc820502d7c
- SHA1 ea2fa6ba232d72ec5b1cf6be6334297a79dc1adb
- SHA512 277673887a20201c44b221fd8f3c9b1fac287bf0da7fec78f4d3f7e4aaf67bbe528a974b7b917426a5c39db3dbe388c833a21b566b69d400eea4e45c35ca3097
- SSDEEP 6144:dGdR+Yk/N8duBmG6t+UnRsRCQ/OJZOg7c:doR+Y4NSG6oUnRsdOJZOg7c
- MD5 SHA1 SHA512 SSDEEP