Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 13:01
Behavioral task
behavioral1
Sample
2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
Resource
win7-20240508-en
General
-
Target
2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe
-
Size
89KB
-
MD5
28d9183f17f18655ad1b77eaf006ac50
-
SHA1
cbcb9be8ae343f977c56f94a84e00c9b0c0e2aeb
-
SHA256
2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283
-
SHA512
4bab4b79095f2542f369c28a28ba2aade894e4740767459fd2b7749ded439e970591f14282ead29d5a533925c6b9deb3db492af2458b413d328ba049dea0b32e
-
SSDEEP
1536:5+4hkM3Yz8wMZhUD2XsjEQWOSkE+Ct6WKBex3GWU5FkWp+AmQwKGSZhCQbIo/tSP:dq6OLM3QasY5Ft71fqWWp+efG4hCQrq
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3644-14-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon behavioral2/memory/3008-16-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe -
Deletes itself 1 IoCs
Processes:
Syslemwojin.exepid process 3008 Syslemwojin.exe -
Executes dropped EXE 1 IoCs
Processes:
Syslemwojin.exepid process 3008 Syslemwojin.exe -
Processes:
resource yara_rule behavioral2/memory/3644-0-0x0000000000400000-0x000000000047F000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\Syslemwojin.exe upx behavioral2/memory/3644-14-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/3008-16-0x0000000000400000-0x000000000047F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exeSyslemwojin.exepid process 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe 3008 Syslemwojin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exedescription pid process target process PID 3644 wrote to memory of 3008 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe Syslemwojin.exe PID 3644 wrote to memory of 3008 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe Syslemwojin.exe PID 3644 wrote to memory of 3008 3644 2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe Syslemwojin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe"C:\Users\Admin\AppData\Local\Temp\2d04be6d0b684c9c116f9f72696c15e91240ea4cded41ad6a72da6e29c35b283.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemwojin.exe"C:\Users\Admin\AppData\Local\Temp\Syslemwojin.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Syslemwojin.exeFilesize
89KB
MD5fb2ad0036ce92c441088e47523853e7c
SHA10ca33512a80693749c68c2b0acb00910d2dd78aa
SHA256e40b19df0cf947aad976f9dd5a9968df505c62e86c1006174f05a4de33c0cd68
SHA5121723ed9e1fc1ba61450abe96b644c360a1476c7133955ad7456f287f3cb41ae978efbb2102bec1e85a393e4127fa3bfe21ca31b7629d80af3a7d3e9cf91f6990
-
C:\Users\Admin\AppData\Local\Temp\lpath.iniFilesize
102B
MD5e12f446f7b76cde0207d70b8101680d9
SHA1b1469a6c47bca4e58822bf9d8b9b600fc4a7bcbd
SHA256b89d6fbf4ff59f005da19a408357820be88ddc847461923f13bbfc994b615d58
SHA512d98dfc57a3b4cd3e884e6a4f76865b353a404b820d0642dc31e7bbcf951f5ca5a22ae0114a30a2d0410c96ed1d0836e3ab25ac2b42aec92fb7ed061db81b64a0
-
memory/3008-16-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3644-0-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3644-14-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB