Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 07:13
Behavioral task
behavioral1
Sample
657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
Resource
win7-20240508-en
General
-
Target
657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
-
Size
8.4MB
-
MD5
65144756960be44e2260648ca49df210
-
SHA1
913aeeeb2f6cdf68561cd092d467437072f73e63
-
SHA256
657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200
-
SHA512
b56a13a10bd36c98f1d7f16702b72fe04acb65417c2442c9965dde550deadf00ec0675fc18dd8e74aa30bb693a392aade00978f99ea1b9d8db63178af2980984
-
SSDEEP
196608:PYPDPyklrNDbtXRd6SdJNJ63ahuoo2/2rZpd3GAA29gp4DVZkK5lp9CmUlXMAkK:gPDPnlFbN6yj63ahXo2/0wAABmViQD9s
Malware Config
Signatures
-
Detect Blackmoon payload 14 IoCs
Processes:
resource yara_rule behavioral1/memory/1792-2-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/1792-1-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/1792-3-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/1792-8-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/1792-10-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/1792-9-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/1792-12-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/1792-11-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2708-50-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2708-51-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2708-49-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/1792-47-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2708-85-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon behavioral1/memory/2708-87-0x0000000000400000-0x0000000000926000-memory.dmp family_blackmoon -
Processes:
resource yara_rule \¡øÕÙ»½Ö®Íõ¡ø\14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exepid process 2708 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe -
Loads dropped DLL 1 IoCs
Processes:
657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exepid process 1792 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exedescription ioc process File opened (read-only) \??\I: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\S: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\T: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\X: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\Z: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\H: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\N: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\R: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\V: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\A: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\E: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\G: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\J: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\L: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\Q: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\U: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\W: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\Y: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\B: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\K: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\M: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\O: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe File opened (read-only) \??\P: 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1608 2708 WerFault.exe 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe -
Processes:
657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exepid process 1792 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe 1792 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe 1792 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe 2708 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe 2708 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe 2708 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exedescription pid process target process PID 1792 wrote to memory of 2708 1792 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe PID 1792 wrote to memory of 2708 1792 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe PID 1792 wrote to memory of 2708 1792 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe PID 1792 wrote to memory of 2708 1792 657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe 14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe"C:\Users\Admin\AppData\Local\Temp\657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\¡øÕÙ»½Ö®Íõ¡ø\14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exeC:\¡øÕÙ»½Ö®Íõ¡ø\14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 8603⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\errorPageStrings[1]Filesize
2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\httpErrorPagesScripts[1]Filesize
8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
C:\Users\Admin\AppData\Local\Temp\37580bfefc69c62994d251e06595ab2f.txtFilesize
16B
MD53e4b53ef7d0e2479c653dd524f972755
SHA18e647d625bc76a27b88ce9269101b5779e736382
SHA256cf82ff3f0a400843276265abe3e1431bdc9f5bbe0d4182137e282e8926fe0991
SHA5125d26848c05fcd48009829e3fef59151d9e61e02c64a2a937884bb58644517fa0e15b1bbd339abadfc5a248ffbff61516414e597797e6e4e907f62a4d8cf642e0
-
\¡øÕÙ»½Ö®Íõ¡ø\14317657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200.exeFilesize
8.4MB
MD565144756960be44e2260648ca49df210
SHA1913aeeeb2f6cdf68561cd092d467437072f73e63
SHA256657e19240ee4616395212673c1157cc40cceebbdae1f360ab9d919ed1ffae200
SHA512b56a13a10bd36c98f1d7f16702b72fe04acb65417c2442c9965dde550deadf00ec0675fc18dd8e74aa30bb693a392aade00978f99ea1b9d8db63178af2980984
-
memory/1792-8-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1792-1-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1792-10-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1792-9-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1792-12-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1792-11-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1792-7-0x000000000091E000-0x000000000091F000-memory.dmpFilesize
4KB
-
memory/1792-2-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1792-0-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1792-3-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/1792-48-0x000000000CC30000-0x000000000D156000-memory.dmpFilesize
5.1MB
-
memory/1792-47-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2708-49-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2708-51-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2708-50-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2708-85-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB
-
memory/2708-87-0x0000000000400000-0x0000000000926000-memory.dmpFilesize
5.1MB