Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 08:37
Static task
static1
Behavioral task
behavioral1
Sample
3a141f5df5cd021d394c98a670eb994eea34a9db28ae726b55d4bc3d585b7930.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3a141f5df5cd021d394c98a670eb994eea34a9db28ae726b55d4bc3d585b7930.dll
Resource
win10v2004-20240426-en
General
-
Target
3a141f5df5cd021d394c98a670eb994eea34a9db28ae726b55d4bc3d585b7930.dll
-
Size
2.1MB
-
MD5
c74de0740e0317a3dd0900d1ef6f3f87
-
SHA1
9654db437de3d8d40189fdfc1382bffa035d7267
-
SHA256
3a141f5df5cd021d394c98a670eb994eea34a9db28ae726b55d4bc3d585b7930
-
SHA512
7817b180126dce4984d4232e9183a8ad6bb2301511cfce97c13e877e8531758e0c1df633b55decccac380af1b49259578e2cfb9cfa2d4ec183c0f10695abb1a2
-
SSDEEP
49152:fuZHFT52HxnouDEexBnxsi3raMQKYOG6YjCNfbyI+Wm1:fuJFTyxDDECBer4YLqjy11
Malware Config
Signatures
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/2380-3-0x0000000010000000-0x000000001042B000-memory.dmp family_blackmoon -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2380 rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2380 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 820 wrote to memory of 2380 820 rundll32.exe 28 PID 820 wrote to memory of 2380 820 rundll32.exe 28 PID 820 wrote to memory of 2380 820 rundll32.exe 28 PID 820 wrote to memory of 2380 820 rundll32.exe 28 PID 820 wrote to memory of 2380 820 rundll32.exe 28 PID 820 wrote to memory of 2380 820 rundll32.exe 28 PID 820 wrote to memory of 2380 820 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a141f5df5cd021d394c98a670eb994eea34a9db28ae726b55d4bc3d585b7930.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a141f5df5cd021d394c98a670eb994eea34a9db28ae726b55d4bc3d585b7930.dll,#12⤵
- Blocklisted process makes network request
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:2380
-