Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 07:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
- Target 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe
- Size 4.1MB
- Sample240528-hsqc8abd42
- SHA256 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8
- MD5 99f237c87818bc9d3f6338513b342fc6
- SHA1 d84f37fb1f7733d2d4803ceb4e2e20b56bd3586e
- SHA512 25b31ff0a78f3031793c8e95c522aed56ca3c93730b60fae05b53c54f303bd25a40b5c253a1ae695071b4fdc220bd7f79c1e12c26ea35be9ca9ac60f8ccddf1c
- SSDEEP 98304:40jRYtqix5BMw6RbVLhvbsObeZyoO9Ksrs494ICRWzNupXf6+3:HL/d1eZyoOAos4Wwcpi+3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral2/memory/396-19-0x0000000000400000-0x000000000065D000-memory.dmp family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe - Executes dropped EXE 1 IoCs
pid Process 396 Launcher.exe -
resource yara_rule behavioral2/files/0x000b000000023400-7.dat upx behavioral2/memory/396-15-0x0000000000400000-0x000000000065D000-memory.dmp upx behavioral2/memory/396-19-0x0000000000400000-0x000000000065D000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 396 Launcher.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 396 Launcher.exe 396 Launcher.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1092 wrote to memory of 396 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 99 PID 1092 wrote to memory of 396 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 99 PID 1092 wrote to memory of 396 1092 19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe"C:\Users\Admin\AppData\Local\Temp\19a98032c1bfe78107b5612584e879bdec246d49126002ec66cf433c47dde2a8.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Launcher.exe
- Size 1.1MB
- SHA256 e432c1763a264ec220e4cbac785a2cbd83e99960d58ffb2ea3d2ecde967f24e8
- MD5 816e800a53e27d9257da0f8e465e308a
- SHA1 21b56a386e0afbe697e621d896a44a422b773e31
- SHA512 c23ee2c4caaca0721e16e84d2472812ffeaf174076c6e8b64e78400d2ffdc5eae5d63fe20992dc1d4007e33f74ef4b10ce487e4275e44f5ec37ddeae721d22cc
- SSDEEP 24576:plZQVInCUlKLRVIoUQcaJhzcmq4ldSXkxWDCPMxu:RQVInCU4NDUQccAkxW3U
- MD5 SHA1 SHA512 SSDEEP