Analysis
-
max time kernel
136s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 10:37
Static task
static1
Behavioral task
behavioral1
Sample
fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe
Resource
win7-20240221-en
General
-
Target
fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe
-
Size
10.0MB
-
MD5
0f76bcc0a7de6edf80f35d4dc05e28d4
-
SHA1
b2e1f3e1b640089208c509329e34831404efd55e
-
SHA256
fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a
-
SHA512
eeb3485ba73db10b0bb45f125f4cee745456f2f7cd8e6419c5561ac0f79f1f359783063f341afd3a9c8a1d87b9b01dc7d749c93ea126893ba71e871ee0b4fcd9
-
SSDEEP
196608:QpOfjom+j8qq1USf/7+qqWRD31fqzO7P95lv77q/ANPYRuY+Ge:TV+YqqPT+aD3FqslvCI9Y
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2980-56-0x0000000000400000-0x00000000018A7000-memory.dmp family_blackmoon behavioral2/memory/2980-57-0x0000000000400000-0x00000000018A7000-memory.dmp family_blackmoon behavioral2/memory/2980-59-0x0000000000400000-0x00000000018A7000-memory.dmp family_blackmoon behavioral2/memory/2980-60-0x0000000000400000-0x00000000018A7000-memory.dmp family_blackmoon -
Processes:
resource yara_rule behavioral2/memory/2980-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2980-17-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exepid process 2980 fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exepid process 2980 fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe 2980 fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exepid process 2980 fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe 2980 fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe 2980 fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe"C:\Users\Admin\AppData\Local\Temp\fa98ffa604364a4ecd82d230146afd3bad42d60e53ff9e6bd52cfa8dc88f648a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2980
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2980-0-0x0000000003800000-0x00000000039A7000-memory.dmpFilesize
1.7MB
-
memory/2980-1-0x0000000003800000-0x00000000039A7000-memory.dmpFilesize
1.7MB
-
memory/2980-2-0x0000000000400000-0x00000000018A7000-memory.dmpFilesize
20.7MB
-
memory/2980-3-0x0000000003800000-0x00000000039A7000-memory.dmpFilesize
1.7MB
-
memory/2980-4-0x0000000001940000-0x0000000001941000-memory.dmpFilesize
4KB
-
memory/2980-11-0x0000000000C30000-0x0000000000EA9000-memory.dmpFilesize
2.5MB
-
memory/2980-9-0x0000000001AF0000-0x0000000001AF1000-memory.dmpFilesize
4KB
-
memory/2980-8-0x0000000001AD0000-0x0000000001AD1000-memory.dmpFilesize
4KB
-
memory/2980-7-0x0000000001AC0000-0x0000000001AC1000-memory.dmpFilesize
4KB
-
memory/2980-6-0x0000000001AB0000-0x0000000001AB1000-memory.dmpFilesize
4KB
-
memory/2980-5-0x0000000001A80000-0x0000000001A81000-memory.dmpFilesize
4KB
-
memory/2980-12-0x0000000000400000-0x00000000018A7000-memory.dmpFilesize
20.7MB
-
memory/2980-13-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-53-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-51-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-49-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-47-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-45-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-43-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-39-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-37-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-35-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-33-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-29-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-27-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-25-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-23-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-21-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-20-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-55-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-15-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-14-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-41-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-32-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-17-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2980-56-0x0000000000400000-0x00000000018A7000-memory.dmpFilesize
20.7MB
-
memory/2980-57-0x0000000000400000-0x00000000018A7000-memory.dmpFilesize
20.7MB
-
memory/2980-58-0x0000000000C30000-0x0000000000EA9000-memory.dmpFilesize
2.5MB
-
memory/2980-59-0x0000000000400000-0x00000000018A7000-memory.dmpFilesize
20.7MB
-
memory/2980-60-0x0000000000400000-0x00000000018A7000-memory.dmpFilesize
20.7MB
-
memory/2980-61-0x0000000000C30000-0x0000000000EA9000-memory.dmpFilesize
2.5MB