Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 22:31
Behavioral task
behavioral1
Sample
4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
General
- Target 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe
- Size 92KB
- Sample240613-2fewhashma
- SHA256 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a
- MD5 f07399d9b97458bcd8b40d82e42f5a88
- SHA1 285112817afe658d72d04afcc9889e21c7775e03
- SHA512 f6ef52f0fc8462fd03f0770ce4719c1d2fdec109053dbcabb38ed5cad6033d156e378f5ba39a07c9c7ae34eda1e1a3b0ea08bf23996abdef0dce3e4bf6db1b08
- SSDEEP 1536:Q/vTGudTe5k4Lo8KI2Z4yNcR5Mpk7WO9f2zXGYxTIx9JL8IoQ6CqZphkN:Q/bhOrBKIq4XR5Mpp+fw2CIx9JLYpkN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/1988-14-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon behavioral2/memory/2812-16-0x0000000000400000-0x000000000047F000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/1988-0-0x0000000000400000-0x000000000047F000-memory.dmp UPX behavioral2/files/0x000b0000000235a8-9.dat UPX behavioral2/memory/1988-14-0x0000000000400000-0x000000000047F000-memory.dmp UPX behavioral2/memory/2812-16-0x0000000000400000-0x000000000047F000-memory.dmp UPX - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe - Deletes itself 1 IoCs
pid Process 2812 Syslemkphqs.exe - Executes dropped EXE 1 IoCs
pid Process 2812 Syslemkphqs.exe -
resource yara_rule behavioral2/memory/1988-0-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/files/0x000b0000000235a8-9.dat upx behavioral2/memory/1988-14-0x0000000000400000-0x000000000047F000-memory.dmp upx behavioral2/memory/2812-16-0x0000000000400000-0x000000000047F000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe 2812 Syslemkphqs.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2812 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 92 PID 1988 wrote to memory of 2812 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 92 PID 1988 wrote to memory of 2812 1988 4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe"C:\Users\Admin\AppData\Local\Temp\4c287ac0c210b588ce68a5a23142eeef11b44c5f660b0c01b19f1b81bb12287a.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\Syslemkphqs.exe"C:\Users\Admin\AppData\Local\Temp\Syslemkphqs.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4628,i,1400471177590024469,587385956640537806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:81⤵PID:3404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Syslemkphqs.exe
- Size 92KB
- SHA256 2d1823ab43df7f377b5770b19fd0e4445dbeaa72d97f4b3a8d67cd2eeae26f95
- MD5 ebf8a45197924dbff52d16ec5685a59b
- SHA1 88319b8775dfe91e92b337f1d0a4faa038398cdd
- SHA512 acfd015e1d1abf650506d4e1966858940fc1490667cae8dfce41c02aac579aa1f052edd996ce04f7eec7af054369eaa703d6eca2dbf40ebdd439e053e797f931
- SSDEEP 1536:Q/vTGudTe5k4Lo8KI2Z4yNcR5Mpk7WO9f2zXGYxTIx9JL8IoQ6CqZphkN:Q/bhOrBKIq4XR5Mpp+fw2CIx9JLYpkN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\lpath.ini
- Size 102B
- SHA256 def1e923fc096c5a78a92245cdff4b67b0fa4ede8800986fbdddeff2ad05a6db
- MD5 c4ddc17eee2d8d17a84f84d1ea4c7a5c
- SHA1 31f5a1d0ab5b90a4b2c588612207edacdd749149
- SHA512 0da5f53c240e2155cc0e240e9c407ce796212f0befdc9778e17968d148110e73239a701d8c2101b84041dce317beded5df59560516de293d204ec7c9855f2245
- MD5 SHA1 SHA512