Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 19:57
Behavioral task
behavioral1
Sample
121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe
-
Size
7.3MB
-
MD5
ad169cadd92d81106e122a886cf047b7
-
SHA1
02eaa8fdd828c71cce758c16ead9dc9daba18c2c
-
SHA256
121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794
-
SHA512
87fc38bbfb59bac89f8136aefc36be99ea2536ed2e42539049f3285a0b54f08428ab5c916fc58efc57b4efe6ec1cd4601d1368dc70441911e20dd08568c21c53
-
SSDEEP
98304:p31GEHiCXqnSCVacVkkrnCfSNNEVzKMki:6EVESCNvrCa4tV
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral1/memory/1664-6-0x0000000000400000-0x0000000000B7C000-memory.dmp family_blackmoon behavioral1/memory/1664-7-0x0000000000400000-0x0000000000B7C000-memory.dmp family_blackmoon behavioral1/memory/1664-51-0x0000000000400000-0x0000000000B7C000-memory.dmp family_blackmoon behavioral1/memory/1664-52-0x0000000000400000-0x0000000000B7C000-memory.dmp family_blackmoon -
resource yara_rule behavioral1/memory/1664-1-0x0000000010000000-0x000000001001E000-memory.dmp upx behavioral1/memory/1664-8-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-9-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-10-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-14-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-16-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-20-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-22-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-18-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-12-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-30-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-34-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-42-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-44-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-50-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-48-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-46-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-40-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-38-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-36-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-32-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-28-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-26-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx behavioral1/memory/1664-24-0x0000000000BC0000-0x0000000000BFE000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe 1664 121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe"C:\Users\Admin\AppData\Local\Temp\121fe9ed20df7c32e9adda8295f99389061a1498767bdf8952fe64d75ffb0794.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1664