Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 14:23
Static task
static1
Behavioral task
behavioral1
Sample
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe
Resource
win7-20240220-en
General
-
Target
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe
-
Size
13.0MB
-
MD5
9f4dcb41af5096272ebcd84649a84d8f
-
SHA1
dc84d62d3c91b99eea8e8ee438f2daa12f68de15
-
SHA256
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e
-
SHA512
4c0f2d712b48d3c44a34c6f11b2402f66767483b9f33125d9ee27ecfbbae6ce77c740170f7a6eaa9423d80f1187fcee0475bd682816256ba644fab014e5f3579
-
SSDEEP
196608:GNH5Zq984XyV3G0aXGkFHQajfz8+Ll/nW0ma8zrtvqTn0bBfuew1fuSzb1lj:GNZ+84F0eFwaH8O/WRa8fU70llpG1l
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2912-45-0x0000000000401000-0x0000000000F53000-memory.dmp family_blackmoon behavioral1/memory/2912-46-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-47-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-48-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-49-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-50-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-51-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-52-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-53-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-54-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-55-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-56-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-57-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-58-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-59-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-60-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-61-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral1/memory/2912-64-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Processes:
resource yara_rule behavioral1/memory/2912-6-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-16-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-24-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-32-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-40-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-44-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-42-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-38-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-36-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-34-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-30-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-28-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-26-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-22-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-20-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-18-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-14-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-12-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-10-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-8-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-4-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-3-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/memory/2912-2-0x00000000002A0000-0x00000000002DF000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exepid process 2912 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exepid process 2912 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exedescription pid process Token: SeDebugPrivilege 2912 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exepid process 2912 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe 2912 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe 2912 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe 2912 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe 2912 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe"C:\Users\Admin\AppData\Local\Temp\9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2912-0-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-1-0x0000000077220000-0x0000000077222000-memory.dmpFilesize
8KB
-
memory/2912-6-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-16-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-24-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-32-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-40-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-45-0x0000000000401000-0x0000000000F53000-memory.dmpFilesize
11.3MB
-
memory/2912-46-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-44-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-42-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-38-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-36-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-34-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-30-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-28-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-26-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-22-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-20-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-18-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-14-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-12-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-10-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-8-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-4-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-3-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-2-0x00000000002A0000-0x00000000002DF000-memory.dmpFilesize
252KB
-
memory/2912-47-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-48-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-49-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-50-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-51-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-52-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-53-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-54-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-55-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-56-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-57-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-58-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-59-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-60-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-61-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2912-64-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB