Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 05:41
Behavioral task
behavioral1
Sample
dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe
Resource
win7-20240508-en
General
-
Target
dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe
-
Size
569KB
-
MD5
e454759e04d8b7c206f89de321915188
-
SHA1
5ebaaeb07a0aa20b813af6e419572f1e31e720cd
-
SHA256
dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3
-
SHA512
d8ccedb212312c4c008a310c816d3fe5f81ff737b6c518080502a77078f70e8df083ce460cc81ce7d26eae20c9bca4cdb269632844a0dc6f1c0bdc9698175538
-
SSDEEP
12288:2vbWLlvJZBMKaYiLi9LXitlv8nc/WVKXvLnvaS70gwTWAV1kbKgxuHKE6:2veJZBMl2Vifvt/rh70/WAEKggc
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3936-13-0x0000000000400000-0x0000000000562000-memory.dmp family_blackmoon -
Processes:
resource yara_rule behavioral2/memory/3936-0-0x0000000000400000-0x0000000000562000-memory.dmp upx behavioral2/memory/3936-13-0x0000000000400000-0x0000000000562000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exedescription ioc process File opened (read-only) \??\T: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\U: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\V: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\E: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\H: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\I: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\M: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\R: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\Y: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\Z: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\G: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\L: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\O: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\P: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\B: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\K: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\Q: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\X: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\A: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\J: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\N: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\S: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe File opened (read-only) \??\W: dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exedescription pid process Token: SeShutdownPrivilege 3936 dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe Token: SeCreatePagefilePrivilege 3936 dd5c88a0e9029aef77df7e7aceef3aec2c48fd701d655dc25da18b619d4c01c3.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
memory/3936-0-0x0000000000400000-0x0000000000562000-memory.dmpFilesize
1.4MB
-
memory/3936-1-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/3936-13-0x0000000000400000-0x0000000000562000-memory.dmpFilesize
1.4MB