Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 19:38
Behavioral task
behavioral1
Sample
ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
General
-
Target
ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe
-
Size
6.4MB
-
MD5
05d61e08ddfd28792276bb7fd4f1bb90
-
SHA1
dfd1bb53cb3ab5206e543c8a3859e1e5a18a9163
-
SHA256
ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68
-
SHA512
76f5127d55c23419345dc7f47c47d915ecc4d593a55b4f426de4e10e17dc2729d51634612c5fd1832125c0024286ad53af8e20a31e3a30bbe4b581b71941e207
-
SSDEEP
98304:lxGwZA9zHntf0LNCXtgxdRsgznLy+OH7yG+HCvzc7szMoIeCxGJYhAt68F:lhZAdHt+NtV7LxmkEzDPCxGJt6W
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1872-9-0x0000000000400000-0x0000000001128000-memory.dmp family_blackmoon behavioral1/memory/1872-13-0x0000000000400000-0x0000000001128000-memory.dmp family_blackmoon -
Processes:
resource yara_rule behavioral1/memory/1872-9-0x0000000000400000-0x0000000001128000-memory.dmp vmprotect behavioral1/memory/1872-13-0x0000000000400000-0x0000000001128000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exepid process 1872 ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2632 1872 WerFault.exe ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exepid process 1872 ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exepid process 1872 ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe 1872 ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exedescription pid process target process PID 1872 wrote to memory of 2632 1872 ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe WerFault.exe PID 1872 wrote to memory of 2632 1872 ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe WerFault.exe PID 1872 wrote to memory of 2632 1872 ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe WerFault.exe PID 1872 wrote to memory of 2632 1872 ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe"C:\Users\Admin\AppData\Local\Temp\ff56710d812db81717d66aff453b7522fce9cd0c53a02ae170798bdb27d4be68.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 5602⤵
- Program crash
PID:2632
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1872-0-0x0000000000734000-0x0000000000BC3000-memory.dmpFilesize
4.6MB
-
memory/1872-5-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1872-3-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1872-1-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1872-9-0x0000000000400000-0x0000000001128000-memory.dmpFilesize
13.2MB
-
memory/1872-10-0x0000000000380000-0x0000000000382000-memory.dmpFilesize
8KB
-
memory/1872-12-0x0000000000734000-0x0000000000BC3000-memory.dmpFilesize
4.6MB
-
memory/1872-13-0x0000000000400000-0x0000000001128000-memory.dmpFilesize
13.2MB