blackmoon | 2024-06-20_e6ae86bbc99c60a3480567181cdb7182_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-20_e6ae86bbc99c60a3480567181cdb7182_mafia
Size 1.4MB
Sample240620-bj9beazhjf
SHA256 4b4ae1898242ca566a9750849b615debc055f9c05e36a53e20b0bed807a2ff56
MD5 e6ae86bbc99c60a3480567181cdb7182
SHA1 222bbe15ba563029e64286d4105bbcc9430e0244
SHA512 a303e59c634f7e144cb031f7af303d6aab2343b698cece088ecbefd6538031b79561b317d6cbd1e18837196079c44c8557e248ed8acd82fe6012d9fd221e5a3b
SSDEEP 24576:g1UGLrmwPVsjEkazzCmqpslRI4/iK6LfGJErGCkfp0sUPYud9mj1uRyRskdr:gu2jkaqmqpwOOiMeGPfp0sUPYu7UQqfr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

File Explorer

2024-06-20_e6ae86bbc99c60a3480567181cdb7182_mafia

.exe 1.4MB

2024-06-20_e6ae86bbc99c60a3480567181cdb7182_mafia

IMPHASH 3de9f24603dcb1035ffa9736c3f2f4ba
SHA256 4b4ae1898242ca566a9750849b615debc055f9c05e36a53e20b0bed807a2ff56
MD5 e6ae86bbc99c60a3480567181cdb7182
SHA1 222bbe15ba563029e64286d4105bbcc9430e0244
SHA512 a303e59c634f7e144cb031f7af303d6aab2343b698cece088ecbefd6538031b79561b317d6cbd1e18837196079c44c8557e248ed8acd82fe6012d9fd221e5a3b
SSDEEP 24576:g1UGLrmwPVsjEkazzCmqpslRI4/iK6LfGJErGCkfp0sUPYud9mj1uRyRskdr:gu2jkaqmqpwOOiMeGPfp0sUPYu7UQqfr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Blackmoon payload
UPX dump on OEP (original entry point)

PE Signature issue

Digest

1f:7d:f0:00:14:70:c6:5f:0a:c5:b1:c9:ad:93:4d:8e:04:a4:ee:a3:4d:4c:b3:2b:e3:90:77:5f:a5:33:77:ab

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2024

Minor OS version

Major OS version

Entry point

332390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapQueryInformation LCMapStringA GetCommandLineA GetTickCount WritePrivateProfileStringA GetLocalTime FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetDiskFreeSpaceA MulDiv GetCurrentDirectoryA GetVolumeInformationA GetPrivateProfileStringA GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetUserDefaultLCID GetStartupInfoA CreateProcessA ExitProcess CancelWaitableTimer VirtualAlloc VirtualFree TryEnterCriticalSection CreateEventA WaitForMultipleObjects SetEvent HeapReAlloc HeapDestroy DeleteCriticalSection FreeLibrary SetCriticalSectionSpinCount HeapCreate lstrcpyn RtlMoveMemory GlobalMemoryStatusEx GetProcessId GetTimeFormatA GetDateFormatA GetLocaleInfoA GetComputerNameA MoveFileA ReadFile GetFileSizeEx WriteFile SetEndOfFile SetFilePointerEx CreateFileA CreateFileW TlsSetValue IsBadReadPtr TlsGetValue DeleteFileA GetTempPathW lstrlenW SetFileAttributesA GetFileAttributesA GetLongPathNameA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA CreateFileMappingA Process32Next Process32First CreateToolhelp32Snapshot OpenProcess UnmapViewOfFile MapViewOfFile OpenFileMappingA WideCharToMultiByte MultiByteToWideChar GetModuleFileNameA HeapSize TerminateProcess SetThreadAffinityMask HeapFree InterlockedExchange LeaveCriticalSection WaitForSingleObject SetWaitableTimer CreateWaitableTimerA SwitchToThread InterlockedCompareExchange EnterCriticalSection CloseHandle CreateThread SetProcessDEPPolicy HeapAlloc GetProcessHeap InitializeCriticalSectionAndSpinCount GetCurrentProcessId GetCurrentThreadId GetProcAddress LoadLibraryA GetModuleHandleA IsWow64Process GetCurrentProcess GetSystemInfo GetProcessVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA SetFilePointer GetLastError GetDriveTypeA Sleep lstrcpyA lstrlenA SetLastError lstrcatA QueryPerformanceCounter GetVersion HeapSetInformation GetStartupInfoW EncodePointer DecodePointer RtlUnwind RaiseException SetUnhandledExceptionFilter GetModuleHandleW GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsFree InterlockedIncrement InterlockedDecrement GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW VirtualQuery GetStringTypeW LoadLibraryW GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleW EnumSystemLocalesA IsValidLocale lstrcmpiA lstrcmpA GlobalDeleteAtom LocalFree lstrcpynA LocalAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc LocalReAlloc GlobalFlags GetModuleHandleA GetProcessHeap HeapAlloc HeapFree RtlMoveMemory GetProcAddress FreeLibrary LoadLibraryA VirtualProtectEx LCMapStringA IsBadReadPtr GetEnvironmentVariableA ExitProcess

user32

CallNextHookEx GetKeyState GetNextDlgTabItem GetFocus EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions TabbedTextOutA DrawTextA GrayStringA UnhookWindowsHookEx DestroyWindow GetDlgCtrlID SetWindowTextA GetMenuItemCount GetWindowPlacement RegisterWindowMessageA GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA SetWindowsHookExA GetTopWindow CopyRect AdjustWindowRectEx GetSysColor MapWindowPoints LoadIconA LoadCursorA GetSysColorBrush LoadStringA DestroyMenu SetActiveWindow GetLastActivePopup IsWindowEnabled EnableWindow SetForegroundWindow SetFocus GetWindowThreadProcessId ShowWindowAsync PostMessageA PostQuitMessage MsgWaitForMultipleObjects IsWindow FindWindowExA DestroyIcon GetForegroundWindow GetDC FillRect DrawIconEx ReleaseDC SendInput GetSystemMetrics MapVirtualKeyA GetLastInputInfo LoadImageA EnumDisplaySettingsA IsIconic IsWindowVisible GetWindowRect GetClientRect ClientToScreen OpenClipboard GetClipboardData GetAncestor CloseClipboard EmptyClipboard SetClipboardData MessageBoxA wsprintfA DispatchMessageA TranslateMessage GetMessageA PeekMessageA GetParent GetWindow PtInRect GetWindowLongA GetWindowTextA SetWindowPos AttachThreadInput SetWindowLongA GetDlgItem SystemParametersInfoA GetClassNameA SendMessageA GetCapture BringWindowToTop MessageBoxA wsprintfA

oleaut32

SafeArrayDestroy VariantClear SysAllocString SafeArrayCreate VariantCopy RegisterTypeLi LHashValOfNameSys LoadTypeLi SystemTimeToVariantTime OleLoadPicture VarR8FromCy VarR8FromBool VariantTimeToSystemTime VariantTimeToSystemTime

shlwapi

PathFindExtensionA PathFindFileNameA

gdi32

GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode GetStockObject GetDeviceCaps SetDIBitsToDevice GetDIBits SetPixelV GetPixel GdiFlush BitBlt GetObjectA CreateDIBSection SetTextColor DeleteDC CreateSolidBrush SelectObject CreateCompatibleBitmap CreateCompatibleDC PtVisible RectVisible TextOutA ExtTextOutA Escape SetBkColor RestoreDC SaveDC CreateBitmap DeleteObject

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextA CryptCreateHash CryptReleaseContext CryptHashData CryptDestroyHash CryptGetHashParam RegOpenKeyA RegCloseKey OpenProcessToken GetTokenInformation RegQueryValueExA

shell32

ShellExecuteExA SHGetFileInfoA ShellExecuteA SHGetSpecialFolderPathW SHGetSpecialFolderPathA

ole32

CoInitializeEx CoUninitialize CoCreateGuid CoInitialize OleRun CoCreateInstance CLSIDFromString CLSIDFromProgID CreateStreamOnHGlobal

msvcrt

sprintf atoi _ftol strchr free malloc strstr

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

comctl32

ord17

generic

count=2, id=14, version=7299,

count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=11, id=152, version=20115,

count=70, id=171, productName=VS2010 build 30319, version=30319,

count=41, id=158, productName=VS2010 build 30319, version=30319,

count=177, id=170, productName=VS2010 build 30319, version=30319,

count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=2, id=93, version=2179,

count=19, id=19, version=8022,

count=22, id=19, version=8034,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=558, id=1, productName=Unmarked objects,

count=119, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=63, productName=Unmarked objects (old),

count=18, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=157, productName=VS2010 build 30319, version=30319,