Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 02:59
Behavioral task
behavioral1
Sample
9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
General
- Target 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe
- Size 436KB
- Sample240520-dgrppage93
- SHA256 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1
- MD5 b252b0ffbbf0f4acc441dc35c4edf4e0
- SHA1 a6e31a9ef7fa64c2ba6bc2e16b350ca15c7edeb3
- SHA512 f9fa5a3183cea04704d718189fb62a75f0a60b5ae6a777cc4284b7f49680d185e82237b2978ee29a5102eecc498cf2a2dc28b7a8367b1b66b4c583abd14536e4
- SSDEEP 6144:dGdR+Yk/N8duBmG6t+UnRsRCQ/OJZOg7q:doR+Y4NSG6oUnRsdOJZOg7q
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral2/files/0x000a0000000232ae-8.dat family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe - Deletes itself 1 IoCs
pid Process 3608 Syslemuyfwv.exe - Executes dropped EXE 1 IoCs
pid Process 3608 Syslemuyfwv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe 3608 Syslemuyfwv.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4780 wrote to memory of 3608 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 93 PID 4780 wrote to memory of 3608 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 93 PID 4780 wrote to memory of 3608 4780 9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe"C:\Users\Admin\AppData\Local\Temp\9897296b77a0f4d70f78b8462a956d50991e2733ab6e1e69f3239694006593a1.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\Syslemuyfwv.exe"C:\Users\Admin\AppData\Local\Temp\Syslemuyfwv.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Syslemuyfwv.exe
- Size 436KB
- SHA256 1a574cdbfadcd424413a5eee43fcb41f2fef4f571805a4ade4139748a8dc2919
- MD5 9831488b05bb94c832de2781dc7c1513
- SHA1 55c86fb4b75ec99753e8ceab58472fcf54c1d43d
- SHA512 7466e55294a9a0bd259cb6d3eacf8678a79b554659d38401e2de8597d700d038a62d517a8ae3d5a7a1f32351d87060c2fdc139728b1f05dcc76fa0eb2ba2649c
- SSDEEP 6144:dGdR+Yk/N8duBmG6t+UnRsRCQ/OJZOg7A:doR+Y4NSG6oUnRsdOJZOg7A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\lpath.ini
- Size 102B
- SHA256 74d907233bde96a1e46200df5523237ad539d13a31a27c6d89142307f7330dac
- MD5 f19c1e40efab8c8951d1301873e485d7
- SHA1 cf81c43ff9be312f21d51c760c59e34c8c1284d6
- SHA512 48ca0ca522710ef52228e6af14a7fc25aa79c7e8af789f900e51699506be26e878cf99b7d848864df4fc1d0a82ebe93396026ed5fb8919048e096274633c8975
- MD5 SHA1 SHA512