Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 05:41
Behavioral task
behavioral1
Sample
dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
General
-
Target
dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe
-
Size
569KB
-
MD5
e454759e04d8b7c206f89de321915188
-
SHA1
5ebaaeb07a0aa20b813af6e419572f1e31e720cd
-
SHA256
dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3
-
SHA512
d8ccedb212312c4c008a310c816d3fe5f81ff737b6c518080502a77078f70e8df083ce460cc81ce7d26eae20c9bca4cdb269632844a0dc6f1c0bdc9698175538
-
SSDEEP
12288:2vbWLlvJZBMKaYiLi9LXitlv8nc/WVKXvLnvaS70gwTWAV1kbKgxuHKE6:2veJZBMl2Vifvt/rh70/WAEKggc
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-4-0x0000000000400000-0x0000000000562000-memory.dmp family_blackmoon -
Processes:
resource yara_rule behavioral1/memory/1964-0-0x0000000000400000-0x0000000000562000-memory.dmp upx behavioral1/memory/1964-4-0x0000000000400000-0x0000000000562000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exedescription ioc process File opened (read-only) \??\B: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\H: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\J: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\S: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\V: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\U: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\I: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\L: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\M: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\N: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\P: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\Q: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\T: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\K: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\X: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\Z: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\A: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\E: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\G: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\O: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\R: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\W: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\Y: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1964-0-0x0000000000400000-0x0000000000562000-memory.dmpFilesize
1.4MB
-
memory/1964-1-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/1964-2-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1964-4-0x0000000000400000-0x0000000000562000-memory.dmpFilesize
1.4MB