Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 11:37
Behavioral task
behavioral1
Sample
f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe
Resource
win7-20240508-en
General
-
Target
f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe
-
Size
431KB
-
MD5
6f882a62faa48c6722bd0da1b34c26a4
-
SHA1
e47f36f68f92f6c7e57e92379dd63f84e5f682dd
-
SHA256
f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76
-
SHA512
b4c7cd6e25e1a7e909399715bf5a840baf6cfcc2f156d5a1c7a80377f98efb09c646eca9841734afb737ed8182f210fd492899030013c65bb286c45219b8452e
-
SSDEEP
3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKU4:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+b
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Systemhjzkp.exe family_blackmoon -
Deletes itself 1 IoCs
Processes:
Systemhjzkp.exepid process 2704 Systemhjzkp.exe -
Executes dropped EXE 1 IoCs
Processes:
Systemhjzkp.exepid process 2704 Systemhjzkp.exe -
Loads dropped DLL 2 IoCs
Processes:
f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exepid process 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exeSystemhjzkp.exepid process 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe 2704 Systemhjzkp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exedescription pid process target process PID 1952 wrote to memory of 2704 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe Systemhjzkp.exe PID 1952 wrote to memory of 2704 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe Systemhjzkp.exe PID 1952 wrote to memory of 2704 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe Systemhjzkp.exe PID 1952 wrote to memory of 2704 1952 f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe Systemhjzkp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe"C:\Users\Admin\AppData\Local\Temp\f18b2d9ca2caf1b7b8b1913c886a112e18769c71200bccb5f1cb2be2b034eb76.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Systemhjzkp.exe"C:\Users\Admin\AppData\Local\Temp\Systemhjzkp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\path.iniFilesize
102B
MD57f8645fb30d48c7c334029db7c62e08b
SHA12564e0f0bbca93551e1e0e90c8c6e1ea0add3dfd
SHA256b9f4bedb94b3cb881f9ffe78611f95e059a2325ef1b0e96f5804593c24bcb762
SHA512c732d508ca4e997308e06971f068c6a82dfcce68766e63fe1ef95a9dc085ae801911aa2e7bb6d3bf42e8460049b5fd39cf5014a3c300f19751304f647a589cff
-
\Users\Admin\AppData\Local\Temp\Systemhjzkp.exeFilesize
431KB
MD59fafe913d5e0a0d9c4944c27eb08475b
SHA1b7b57f436d6164b9510355f296a85b7efc0749e2
SHA256f2d79a72e8ebf8c580306c0cbfe6ebf6e0810a66500a64613a80beef2aebf7f1
SHA5122af1d14de765bc2c9e7dc85684ae1f2e0fae0ece6e85628fde3f2a414ffec805ce1a482d612c64a2b31134fc26ed19e1dda86c577cf78dd0b13b621454a19fec