Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 10:54
Static task
static1
Behavioral task
behavioral1
Sample
5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe
Resource
win7-20240508-en
General
-
Target
5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe
-
Size
15.8MB
-
MD5
cca29256eec1ebd787ebefb41b9507f9
-
SHA1
51fd07230ff7526ec9958b81c6a3b3feb7df9311
-
SHA256
5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a
-
SHA512
799de3a12bc0a7ad81b4cebd42452ba5c0df169ef6e2a7dfa8caf2661fce7f4d186f844536185de8e700ab1cfaa92f03896bb77208801ba1a82a87ef1c2bfd77
-
SSDEEP
393216:iO6k5pGNv3odC5M3LhAvxsbsCIHcPfGF0I5s:16k5pGtR5M3LaysDcPm0Z
Malware Config
Signatures
-
Detect Blackmoon payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1976-6-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/1976-7-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/1976-9-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/1976-8-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/1976-12-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/1976-11-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/1976-10-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/1976-38-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/1736-66-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon behavioral1/memory/1736-67-0x0000000000400000-0x00000000009FA000-memory.dmp family_blackmoon -
Executes dropped EXE 1 IoCs
Processes:
223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exepid process 1736 223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe -
Loads dropped DLL 1 IoCs
Processes:
5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exepid process 1976 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exedescription ioc process File opened (read-only) \??\U: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\E: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\K: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\M: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\Q: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\S: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\W: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\X: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\Y: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\A: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\I: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\O: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\P: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\Z: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\R: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\T: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\V: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\B: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\G: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\H: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\N: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\J: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe File opened (read-only) \??\L: 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main 223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exepid process 1976 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe 1976 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe 1976 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe 1736 223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe 1736 223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe 1736 223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exedescription pid process target process PID 1976 wrote to memory of 1736 1976 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe 223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe PID 1976 wrote to memory of 1736 1976 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe 223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe PID 1976 wrote to memory of 1736 1976 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe 223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe PID 1976 wrote to memory of 1736 1976 5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe 223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe"C:\Users\Admin\AppData\Local\Temp\5dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\9SF¿ñ±©ÃÔʧ\223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exeC:\9SF¿ñ±©ÃÔʧ\223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\afbcb30d43c877e203e940f360e52633.txtFilesize
15B
MD5c4aafd32bf8ff729e032a8dae8078d6e
SHA1afcfdefcd312b7b120df56340bba66c8ff76c3b4
SHA25650b00ec5dc1a11412c6e6089cca079f5fe559e7b783f6be3b41adf6358ea3497
SHA51252bc7eca57775e8c7c77061b9d13d0f62953788180b4642653f2a5b83360b48771b64ac332b411e7ee2a6b88ff04da2bafbb4242cf739866628cc17697acef0d
-
\9SF¿ñ±©ÃÔʧ\223635dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a.exeFilesize
15.8MB
MD5cca29256eec1ebd787ebefb41b9507f9
SHA151fd07230ff7526ec9958b81c6a3b3feb7df9311
SHA2565dd860224e4d01162786c5a14f7b0653c720c1880394abd0c2714122e912c98a
SHA512799de3a12bc0a7ad81b4cebd42452ba5c0df169ef6e2a7dfa8caf2661fce7f4d186f844536185de8e700ab1cfaa92f03896bb77208801ba1a82a87ef1c2bfd77
-
memory/1736-67-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1736-66-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1736-41-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-11-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-8-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-12-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-0-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-10-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-9-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-7-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-40-0x000000000D340000-0x000000000D93A000-memory.dmpFilesize
6.0MB
-
memory/1976-38-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-37-0x0000000000230000-0x0000000000233000-memory.dmpFilesize
12KB
-
memory/1976-6-0x0000000000400000-0x00000000009FA000-memory.dmpFilesize
6.0MB
-
memory/1976-5-0x00000000004FF000-0x0000000000500000-memory.dmpFilesize
4KB
-
memory/1976-1-0x0000000000230000-0x0000000000233000-memory.dmpFilesize
12KB