Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exe
-
Size
9.4MB
-
MD5
6613dac29edc23011eba67795d301e76
-
SHA1
84cd3432a0b854667b55c889535ac1aa6a0beda5
-
SHA256
de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48
-
SHA512
4297d93240f686ec003dbe186d870677c9dd68b14d922500f28c5ba3cf5674b786bb872958e7d3220349ada61feaf30823405ccacbec518b390d134d0024540d
-
SSDEEP
196608:+VUnc32/SYNcEHQfCd6dWkUSgW38E9MWGNMc3gSxP:Znc32/SYNcEwNWkNgWsE6WGNFwU
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3484-3-0x0000000000400000-0x0000000001AF5000-memory.dmp family_blackmoon behavioral2/memory/3484-10-0x0000000000400000-0x0000000001AF5000-memory.dmp family_blackmoon behavioral2/memory/3484-11-0x0000000000400000-0x0000000001AF5000-memory.dmp family_blackmoon behavioral2/memory/3484-12-0x0000000000400000-0x0000000001AF5000-memory.dmp family_blackmoon behavioral2/memory/3484-13-0x0000000000400000-0x0000000001AF5000-memory.dmp family_blackmoon behavioral2/memory/3484-14-0x0000000000400000-0x0000000001AF5000-memory.dmp family_blackmoon -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exepid process 3484 de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exepid process 3484 de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exe 3484 de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exepid process 3484 de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exe 3484 de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exe"C:\Users\Admin\AppData\Local\Temp\de98399bd563fa1b07bc818de47f3e0b55ff0adede05c97c83a879c384959d48.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3484
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3484-4-0x0000000000E93000-0x0000000001188000-memory.dmpFilesize
3.0MB
-
memory/3484-1-0x00000000020D0000-0x00000000020D1000-memory.dmpFilesize
4KB
-
memory/3484-0-0x0000000001B50000-0x0000000001B51000-memory.dmpFilesize
4KB
-
memory/3484-3-0x0000000000400000-0x0000000001AF5000-memory.dmpFilesize
23.0MB
-
memory/3484-6-0x0000000010000000-0x00000000101BA000-memory.dmpFilesize
1.7MB
-
memory/3484-10-0x0000000000400000-0x0000000001AF5000-memory.dmpFilesize
23.0MB
-
memory/3484-11-0x0000000000400000-0x0000000001AF5000-memory.dmpFilesize
23.0MB
-
memory/3484-12-0x0000000000400000-0x0000000001AF5000-memory.dmpFilesize
23.0MB
-
memory/3484-13-0x0000000000400000-0x0000000001AF5000-memory.dmpFilesize
23.0MB
-
memory/3484-14-0x0000000000400000-0x0000000001AF5000-memory.dmpFilesize
23.0MB
-
memory/3484-15-0x0000000000E93000-0x0000000001188000-memory.dmpFilesize
3.0MB