Analysis
-
max time kernel
141s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:23
Static task
static1
Behavioral task
behavioral1
Sample
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe
Resource
win7-20240220-en
General
-
Target
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe
-
Size
13.0MB
-
MD5
9f4dcb41af5096272ebcd84649a84d8f
-
SHA1
dc84d62d3c91b99eea8e8ee438f2daa12f68de15
-
SHA256
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e
-
SHA512
4c0f2d712b48d3c44a34c6f11b2402f66767483b9f33125d9ee27ecfbbae6ce77c740170f7a6eaa9423d80f1187fcee0475bd682816256ba644fab014e5f3579
-
SSDEEP
196608:GNH5Zq984XyV3G0aXGkFHQajfz8+Ll/nW0ma8zrtvqTn0bBfuew1fuSzb1lj:GNZ+84F0eFwaH8O/WRa8fU70llpG1l
Malware Config
Signatures
-
Detect Blackmoon payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/2892-45-0x0000000000401000-0x0000000000F53000-memory.dmp family_blackmoon behavioral2/memory/2892-46-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral2/memory/2892-47-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral2/memory/2892-48-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral2/memory/2892-49-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral2/memory/2892-50-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon behavioral2/memory/2892-53-0x0000000000400000-0x00000000015EE000-memory.dmp family_blackmoon -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Processes:
resource yara_rule behavioral2/memory/2892-2-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-30-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-44-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-43-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-40-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-38-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-36-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-34-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-33-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-28-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-26-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-24-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-22-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-20-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-16-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-14-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-12-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-10-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-8-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-6-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-4-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-3-0x0000000003770000-0x00000000037AF000-memory.dmp upx behavioral2/memory/2892-18-0x0000000003770000-0x00000000037AF000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exepid process 2892 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exepid process 2892 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe 2892 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exedescription pid process Token: SeDebugPrivilege 2892 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exepid process 2892 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe 2892 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe 2892 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe 2892 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe 2892 9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe"C:\Users\Admin\AppData\Local\Temp\9249f0602d102b28efd16582d3e1d0aa33c4c3598ea0d60612a549595742ec7e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2892-0-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2892-1-0x00000000775A4000-0x00000000775A6000-memory.dmpFilesize
8KB
-
memory/2892-2-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-30-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-44-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-43-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-40-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-38-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-36-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-34-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-33-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-28-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-26-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-24-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-22-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-20-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-16-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-14-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-12-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-10-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-8-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-6-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-4-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-3-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-18-0x0000000003770000-0x00000000037AF000-memory.dmpFilesize
252KB
-
memory/2892-45-0x0000000000401000-0x0000000000F53000-memory.dmpFilesize
11.3MB
-
memory/2892-46-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2892-47-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2892-48-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2892-49-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2892-50-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB
-
memory/2892-53-0x0000000000400000-0x00000000015EE000-memory.dmpFilesize
17.9MB