Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 15:24
Static task
static1
Behavioral task
behavioral1
Sample
90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe
Resource
win7-20240221-en
General
-
Target
90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe
-
Size
12.0MB
-
MD5
dfd602e0e91c26540727c7a481ecaf9c
-
SHA1
40c2559af3a2637d4b6ddf5d3c8ecae4eb983ef7
-
SHA256
90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7
-
SHA512
c9762bc5a7f9873374fc57b01b20dc4d26292199fa084986ef1aadefd0019f9bf600169cfa1e47f9750cd0ce4d2dda3cfee22fec3fb67254efdbdf94c3fb2a35
-
SSDEEP
196608:10/mSNwPXEqFGgVyT2kU/k0fsvY0dHzQrWvE/AsbBmKKVRpVhaNNqvm:iOowPhGP2G0EA0dTRE/AscKCpaqvm
Malware Config
Signatures
-
Detect Blackmoon payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2796-6-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2796-7-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2796-9-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2796-8-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2796-19-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2268-26-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2268-28-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2268-52-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/2268-54-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon -
Executes dropped EXE 1 IoCs
Processes:
4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exepid process 2268 4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe -
Loads dropped DLL 1 IoCs
Processes:
90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exepid process 2796 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exedescription ioc process File opened (read-only) \??\R: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\U: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\V: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\H: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\L: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\M: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\P: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\Q: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\S: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\T: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\W: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\X: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\Y: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\A: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\B: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\E: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\G: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\O: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\I: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\J: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\K: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\N: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe File opened (read-only) \??\Z: 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main 4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exepid process 2796 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe 2796 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe 2796 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe 2268 4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe 2268 4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe 2268 4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exedescription pid process target process PID 2796 wrote to memory of 2268 2796 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe 4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe PID 2796 wrote to memory of 2268 2796 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe 4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe PID 2796 wrote to memory of 2268 2796 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe 4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe PID 2796 wrote to memory of 2268 2796 90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe 4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe"C:\Users\Admin\AppData\Local\Temp\90c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Òì¶ÈÖ®ÈÐmh\4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exeC:\Òì¶ÈÖ®ÈÐmh\4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1b9b5b832b9fd9e5034715fb9a408cb6.txtFilesize
14B
MD5d0516ec468684f862fa108a884e63d57
SHA1834e1a05962a48fbc7813e6b980c5208d3c471f0
SHA2566606af1157a10932f0bf3b947e7fb5c85c341acd666cf4f38c509688c6a3678e
SHA5129b09bec786ea793fafa5726350db582a1d0574b0ed0ae2f1256a30bd580f2708e94ea0f2ca951446635e66e26f2cbb8073247bdfeeefa675d490f828fe06e7a6
-
C:\Òì¶ÈÖ®ÈÐmh\4270290c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7.exeFilesize
12.0MB
MD5dfd602e0e91c26540727c7a481ecaf9c
SHA140c2559af3a2637d4b6ddf5d3c8ecae4eb983ef7
SHA25690c3bf20ec8fb1bba1e59b3f2fff90d5f80fbffaaf611eabe31196b5445105e7
SHA512c9762bc5a7f9873374fc57b01b20dc4d26292199fa084986ef1aadefd0019f9bf600169cfa1e47f9750cd0ce4d2dda3cfee22fec3fb67254efdbdf94c3fb2a35
-
memory/2268-21-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2268-54-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2268-52-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2268-28-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2268-26-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2268-22-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2796-7-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2796-8-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2796-20-0x0000000006670000-0x0000000006C6A000-memory.dmpFilesize
6.0MB
-
memory/2796-19-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2796-18-0x0000000000230000-0x0000000000233000-memory.dmpFilesize
12KB
-
memory/2796-9-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2796-0-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2796-6-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/2796-5-0x00000000004FF000-0x0000000000500000-memory.dmpFilesize
4KB
-
memory/2796-1-0x0000000000230000-0x0000000000233000-memory.dmpFilesize
12KB