Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 01:50
Behavioral task
behavioral1
Sample
8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe
Resource
win7-20240508-en
General
-
Target
8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe
-
Size
15.9MB
-
MD5
959eedda9b9d1eb901596997d1c7ef8b
-
SHA1
c6e9d2923e1b06464b61226573656664a7f54850
-
SHA256
8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1
-
SHA512
79384989aca7b6a43865b6b651a7d44f5b0037def630e4152300b85c845e667d5987aae4f47a66cf48cad8156738928395785d6acb78a0bf1172cfbc6c27c5fb
-
SSDEEP
393216:I2g9DhVmtT+WIn4tlsEm1koDYRfOeCME7jnBRvkRcP7lRHJi:LoKNPxb9mMaoRcPRRpi
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2080-3-0x0000000000400000-0x0000000001C2F000-memory.dmp family_blackmoon behavioral1/memory/2080-4-0x0000000000400000-0x0000000001C2F000-memory.dmp family_blackmoon behavioral1/memory/2080-14-0x0000000000400000-0x0000000001C2F000-memory.dmp family_blackmoon -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe -
Loads dropped DLL 1 IoCs
Processes:
8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exepid process 2080 8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe -
Processes:
resource yara_rule behavioral1/memory/2080-0-0x0000000000400000-0x0000000001C2F000-memory.dmp themida behavioral1/memory/2080-2-0x0000000000400000-0x0000000001C2F000-memory.dmp themida behavioral1/memory/2080-3-0x0000000000400000-0x0000000001C2F000-memory.dmp themida behavioral1/memory/2080-4-0x0000000000400000-0x0000000001C2F000-memory.dmp themida behavioral1/memory/2080-14-0x0000000000400000-0x0000000001C2F000-memory.dmp themida -
Processes:
8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exepid process 2080 8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exepid process 2080 8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe 2080 8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe"C:\Users\Admin\AppData\Local\Temp\8a0ec113fa47ba3fbdf80d56ab1ded6b9ef39bff4bdde3a10b990947873509b1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\E2EECore.3.3.9.dllFilesize
10.6MB
MD550c266e46ccf9bc8956279f78d51f205
SHA10ba5b98a91a9a019cd9b87cf01796c65ee6a0839
SHA256c58e066a293ff260037487d37e37bf3d890c16383d817c7573dab51c514cbd00
SHA5127350a82820faeba3172fad3d87b04c6a2967b797a321a78a53e7156c37fed4661a66d2f78e2f3ddbcbc0d10a56f5d761f7eb761f05d2841568b34841c17e0d37
-
memory/2080-0-0x0000000000400000-0x0000000001C2F000-memory.dmpFilesize
24.2MB
-
memory/2080-1-0x0000000077810000-0x0000000077812000-memory.dmpFilesize
8KB
-
memory/2080-2-0x0000000000400000-0x0000000001C2F000-memory.dmpFilesize
24.2MB
-
memory/2080-3-0x0000000000400000-0x0000000001C2F000-memory.dmpFilesize
24.2MB
-
memory/2080-4-0x0000000000400000-0x0000000001C2F000-memory.dmpFilesize
24.2MB
-
memory/2080-11-0x0000000077304000-0x0000000077305000-memory.dmpFilesize
4KB
-
memory/2080-10-0x0000000010000000-0x000000001001A000-memory.dmpFilesize
104KB
-
memory/2080-12-0x00000000772F0000-0x0000000077400000-memory.dmpFilesize
1.1MB
-
memory/2080-13-0x00000000772F0000-0x0000000077400000-memory.dmpFilesize
1.1MB
-
memory/2080-15-0x00000000772F0000-0x0000000077400000-memory.dmpFilesize
1.1MB
-
memory/2080-14-0x0000000000400000-0x0000000001C2F000-memory.dmpFilesize
24.2MB