Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 18:45
Behavioral task
behavioral1
Sample
e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe
Resource
win7-20240220-en
windows7-x64
10 signatures
150 seconds
General
- Target e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe
- Size 89KB
- Sample240610-xeasyawdrc
- SHA256 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b
- MD5 bf9fca4cd65d1d0e6e242733650f7783
- SHA1 7d969fa24c271f7104986eb5e8463c3d803040cd
- SHA512 079577c0807ef3af8a014a510d3c42dc5a4809ab461fc0a0950c167539a7a3084291f084d48ec85f1255a0e256c85b62c9f9ab98ae8da0c218b448b63fa43b8a
- SSDEEP 1536:5+4hkM3Yz8wMZhUD2XsjEQWOSkE+Ct6WKBex3GWU5FkWp+AmQwKGSZhCQbIo/tSI:dq6OLM3QasY5Ft71fqWWp+efG4hCQrR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral2/memory/4020-2-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon behavioral2/memory/4020-4-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon behavioral2/memory/4020-16-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon behavioral2/memory/3836-18-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/4020-0-0x0000000000400000-0x000000000047F000-memory.dmp UPX behavioral2/memory/4020-2-0x0000000000400000-0x000000000047F000-memory.dmp UPX behavioral2/memory/4020-4-0x0000000000400000-0x000000000047F000-memory.dmp UPX behavioral2/files/0x00080000000235df-11.dat UPX behavioral2/memory/4020-16-0x0000000000400000-0x000000000047F000-memory.dmp UPX behavioral2/memory/3836-18-0x0000000000400000-0x000000000047F000-memory.dmp UPX - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe - Deletes itself 1 IoCs
pid Process 3836 Syslemjtjeh.exe - Executes dropped EXE 1 IoCs
pid Process 3836 Syslemjtjeh.exe -
resource yara_rule behavioral2/memory/4020-0-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/4020-2-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/4020-4-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/files/0x00080000000235df-11.dat upx behavioral2/memory/4020-16-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/3836-18-0x0000000000400000-0x000000000047F000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe 3836 Syslemjtjeh.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4020 wrote to memory of 3836 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 97 PID 4020 wrote to memory of 3836 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 97 PID 4020 wrote to memory of 3836 4020 e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe"C:\Users\Admin\AppData\Local\Temp\e46d7c0ef3b8f44d17e5f391e53fdc992c9125e9a99b8c709d623ff865dac21b.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\Syslemjtjeh.exe"C:\Users\Admin\AppData\Local\Temp\Syslemjtjeh.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:81⤵PID:2996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Syslemjtjeh.exe
- Size 89KB
- SHA256 0fe06cba6a348c473a4ed0348ec5c79bd6515b6b3acc2787bf97ff232dad60a9
- MD5 25099b8fa2355422e12b9d33727381e6
- SHA1 8405fc6e9eb5c56eee978949d7f9ccdb003a4f3d
- SHA512 9e02c996ec1c3425dd8e4514e193f93cf564dbd9ef4dda72d9ea06e4dd973aa19e559feaee7ce31a709e2fb986f6627ee5cca5df08a9e41265337436edcb248b
- SSDEEP 1536:5+4hkM3Yz8wMZhUD2XsjEQWOSkE+Ct6WKBex3GWU5FkWp+AmQwKGSZhCQbIo/tSi:dq6OLM3QasY5Ft71fqWWp+efG4hCQrR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\lpath.ini
- Size 102B
- SHA256 f88807a04d048d0bb611268b476c9a0c8814d4d016faf5e7827d1e857846cc87
- MD5 9e79a9808e21509cbdcf8e1f1e447b49
- SHA1 eae0d6ac51aa68f2d119b381c3f9ad57d4d74b1d
- SHA512 3d493b05a00f0b6aec62284e00dd087e6338c738e0e9c426f616ef8b3c903eb914f2eb91a389fcd12469bec4dc7ffc6ad7b365c0c37d388842fa856254f3d923
- MD5 SHA1 SHA512