Malware Analysis Report

2024-11-16 15:03

Sample ID 240620-d74rya1drq
Target b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7
SHA256 b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7
Tags
blackmoon spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7

Threat Level: Known bad

The file b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7 was found to be: Known bad.

Malicious Activity Summary

blackmoon spyware stealer

Blackmoon family

Detect Blackmoon payload

Reads user/profile data of web browsers

Unsigned PE

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 03:39

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 03:39

Reported

2024-06-20 03:42

Platform

win7-20240611-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Processes

C:\Users\Admin\AppData\Local\Temp\b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7.exe

"C:\Users\Admin\AppData\Local\Temp\b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 03:39

Reported

2024-06-20 03:42

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Processes

C:\Users\Admin\AppData\Local\Temp\b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7.exe

"C:\Users\Admin\AppData\Local\Temp\b7c075b81e0b42ce4fd6023ef3ae6ecee804fcd3071d46f3450d377b2c5284f7.exe"

Network

Files

N/A