Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 00:58
Behavioral task
behavioral1
Sample
11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
Resource
win7-20240419-en
General
-
Target
11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
-
Size
13.8MB
-
MD5
55fd7441106c7daec15c1b5a79cea60c
-
SHA1
14d882909f0997f03617b68b47ad70891be88f12
-
SHA256
11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46
-
SHA512
033216c70076f5ec7cd0a78aea635826fc9efece01ff2e47698c806758b1da63ef771777ec6d9ceec8f1c62b6e3e955e8c6a8686139b5a54fe35421dcf927c12
-
SSDEEP
393216:gPDP5EFmyEfXGMXOCNYUl0sW2w+77OTsXdzIO9b5uU:YxEUy0XO1I/Isd9AU
Malware Config
Signatures
-
Detect Blackmoon payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/3488-1-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/3488-2-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/3488-3-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/3488-15-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/5088-20-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/5088-19-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/5088-18-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral2/memory/5088-50-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon -
Processes:
resource yara_rule C:\1.76ÐùÔ¯¡¾HB΢¶Ë¡¿\4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exepid process 5088 4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exedescription ioc process File opened (read-only) \??\A: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\E: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\H: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\I: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\K: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\N: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\V: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\W: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\B: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\G: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\P: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\Q: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\Z: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\J: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\M: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\O: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\S: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\X: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\Y: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\L: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\R: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\T: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe File opened (read-only) \??\U: 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exepid process 3488 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe 3488 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe 3488 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe 5088 4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe 5088 4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe 5088 4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exedescription pid process target process PID 3488 wrote to memory of 5088 3488 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe 4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe PID 3488 wrote to memory of 5088 3488 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe 4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe PID 3488 wrote to memory of 5088 3488 11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe 4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe"C:\Users\Admin\AppData\Local\Temp\11f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\1.76ÐùÔ¯¡¾HB΢¶Ë¡¿\4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exeC:\1.76ÐùÔ¯¡¾HB΢¶Ë¡¿\4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\1.76ÐùÔ¯¡¾HB΢¶Ë¡¿\4086911f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46.exeFilesize
13.8MB
MD555fd7441106c7daec15c1b5a79cea60c
SHA114d882909f0997f03617b68b47ad70891be88f12
SHA25611f756fe86cb42bef76a084b3d5ea248ae186afbf03164c865144878b1547b46
SHA512033216c70076f5ec7cd0a78aea635826fc9efece01ff2e47698c806758b1da63ef771777ec6d9ceec8f1c62b6e3e955e8c6a8686139b5a54fe35421dcf927c12
-
C:\Users\Admin\AppData\Local\Temp\f5eb8834eaf390c911a56e08cecc315a.txtFilesize
22B
MD54bbb6d351502075537991f3c30672925
SHA10752f7de39539b6c13b906f73a6e07c7cb58e3f2
SHA2565a5c82dbb91de09b8ebbe22de9830d51c3c598b132625b4491ca31707f220f6a
SHA512b8c4c7cebbbb4874f0ac9e3c184abbd968f231f8cef444a1068da3a140d3168940ab2ddacaaf4b654968a30e45006994e7e5efe05d40ea857c3b529bad7eddcb
-
memory/3488-7-0x0000000003C80000-0x0000000003C81000-memory.dmpFilesize
4KB
-
memory/3488-3-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/3488-9-0x0000000003CD0000-0x0000000003CD1000-memory.dmpFilesize
4KB
-
memory/3488-8-0x0000000003B10000-0x0000000003B11000-memory.dmpFilesize
4KB
-
memory/3488-0-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/3488-2-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/3488-15-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/3488-1-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/5088-21-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/5088-20-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/5088-19-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/5088-18-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/5088-50-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB