Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 22:57
Static task
static1
Behavioral task
behavioral1
Sample
992597951b73ff1193cbcdee202aaf6758838d6a6b5e4b14d35c9a5d339b8705.exe
Resource
win7-20240221-en
General
-
Target
992597951b73ff1193cbcdee202aaf6758838d6a6b5e4b14d35c9a5d339b8705.exe
-
Size
8.0MB
-
MD5
e3d1633fb6d3203f010908612212c22c
-
SHA1
5de2daf278db3f94273671ffacbe584fdc73e8ee
-
SHA256
992597951b73ff1193cbcdee202aaf6758838d6a6b5e4b14d35c9a5d339b8705
-
SHA512
c026a8bb757dd64b05a4769a5b8ec35f9d3bf9197abc3544cdf1736f207e8cee20c154a38d456f45d5044ec75a86458cc3eb6974e7256e14b1279409385784d1
-
SSDEEP
196608:PxJP9wudlydSXfZT1q6axc0a10aXERxZuahZ:Px/w2yKfS/c9J4Z
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2172-5-0x0000000002A40000-0x0000000002FBD000-memory.dmp family_blackmoon behavioral1/memory/2172-14-0x0000000002A40000-0x0000000002FBD000-memory.dmp family_blackmoon -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2172-6-0x0000000007AA0000-0x0000000007B17000-memory.dmp vmprotect behavioral1/memory/2172-7-0x0000000007AA0000-0x0000000007B17000-memory.dmp vmprotect behavioral1/memory/2172-9-0x0000000007AA0000-0x0000000007B17000-memory.dmp vmprotect behavioral1/memory/2172-10-0x0000000007AA0000-0x0000000007B17000-memory.dmp vmprotect behavioral1/memory/2172-12-0x0000000007AA0000-0x0000000007B17000-memory.dmp vmprotect
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2172-4-0x0000000000400000-0x0000000000C3A000-memory.dmpFilesize
8.2MB
-
memory/2172-3-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2172-1-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2172-0-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2172-5-0x0000000002A40000-0x0000000002FBD000-memory.dmpFilesize
5.5MB
-
memory/2172-6-0x0000000007AA0000-0x0000000007B17000-memory.dmpFilesize
476KB
-
memory/2172-7-0x0000000007AA0000-0x0000000007B17000-memory.dmpFilesize
476KB
-
memory/2172-9-0x0000000007AA0000-0x0000000007B17000-memory.dmpFilesize
476KB
-
memory/2172-10-0x0000000007AA0000-0x0000000007B17000-memory.dmpFilesize
476KB
-
memory/2172-12-0x0000000007AA0000-0x0000000007B17000-memory.dmpFilesize
476KB
-
memory/2172-13-0x0000000000400000-0x0000000000C3A000-memory.dmpFilesize
8.2MB
-
memory/2172-14-0x0000000002A40000-0x0000000002FBD000-memory.dmpFilesize
5.5MB