blackmoon | a713964f539c1bce77b9f274efd10e4d75d3eaca0af5c02155559c8fd1d46275

Sharing

Copy URL Twitter E-mail

General

Target
a713964f539c1bce77b9f274efd10e4d75d3eaca0af5c02155559c8fd1d46275
Size 7.4MB
Sample240621-weabqsyepd
SHA256 a713964f539c1bce77b9f274efd10e4d75d3eaca0af5c02155559c8fd1d46275
MD5 cad9f58126fc20eb021d60e2a61d8c84
SHA1 2f6ef27bacaadd8ab7f35bd05bae576c8a318ae8
SHA512 eb843cabba73a63030c015ac6473c43bd6f53a5ff0c481fc73c88ea1667bd388c4085de5169d1b2ff88cb11f7dad051b8ee982ac5d1e42173a025dff8cd53aaa
SSDEEP 196608:1B0zdrR9L8sl69O49eTdL7Pqt+YmP8tE5G8W7pcXr:/0zdrPL8sl6EP+mP/88V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a713964f539c1bce77b9f274efd10e4d75d3eaca0af5c02155559c8fd1d46275

File Explorer

a713964f539c1bce77b9f274efd10e4d75d3eaca0af5c02155559c8fd1d46275

.exe 7.4MB

a713964f539c1bce77b9f274efd10e4d75d3eaca0af5c02155559c8fd1d46275

IMPHASH c66cfbb92808ea4fef524e789d3c7dd3
SHA256 a713964f539c1bce77b9f274efd10e4d75d3eaca0af5c02155559c8fd1d46275
MD5 cad9f58126fc20eb021d60e2a61d8c84
SHA1 2f6ef27bacaadd8ab7f35bd05bae576c8a318ae8
SHA512 eb843cabba73a63030c015ac6473c43bd6f53a5ff0c481fc73c88ea1667bd388c4085de5169d1b2ff88cb11f7dad051b8ee982ac5d1e42173a025dff8cd53aaa
SSDEEP 196608:1B0zdrR9L8sl69O49eTdL7Pqt+YmP8tE5G8W7pcXr:/0zdrPL8sl6EP+mP/88V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Blackmoon payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

GetStdHandle GetConsoleMode TlsGetValue GetLastError SetLastError RaiseException GetTickCount ExitProcess GetStartupInfoA GetCommandLineA GetCurrentProcessId GetCurrentThreadId GetCurrentProcess ReadProcessMemory GetModuleFileNameA GetModuleHandleA WriteFile ReadFile CloseHandle SetFilePointer SetEndOfFile GetSystemInfo LoadLibraryW LoadLibraryA GetProcAddress FreeLibrary FormatMessageW DeleteFileW CreateFileW GetFileAttributesW CreateDirectoryW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW GetConsoleOutputCP GetOEMCP GetProcessHeap HeapAlloc HeapFree TlsAlloc TlsSetValue CreateThread ExitThread LocalAlloc LocalFree Sleep SuspendThread ResumeThread TerminateThread WaitForSingleObject SetThreadPriority GetThreadPriority GetCurrentThread OpenThread IsDebuggerPresent CreateEventA ResetEvent SetEvent InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection MultiByteToWideChar WideCharToMultiByte GetACP GetConsoleCP RtlUnwind EnumResourceTypesA EnumResourceNamesA EnumResourceLanguagesA FindResourceA FindResourceExA LoadResource SizeofResource LockResource FreeResource GetProcessHandleCount GetEnvironmentStringsA FreeEnvironmentStringsA FormatMessageA GetLogicalDriveStringsA LoadLibraryExA GetEnvironmentVariableA GlobalAddAtomA GetWindowsDirectoryA DeleteFileA CopyFileA GetVersionExA CompareStringA GetLocaleInfoA GetDateFormatA EnumCalendarInfoA QueryFullProcessImageNameA GetModuleFileNameW GetCommandLineW FindNextFileW CompareStringW GetLocaleInfoW GetDateFormatW FindFirstFileExW GlobalAlloc GlobalReAlloc GlobalSize GlobalLock GlobalUnlock VirtualAllocEx VirtualFree VirtualFreeEx GetProcessAffinityMask OpenProcess TerminateProcess GetExitCodeProcess CreateRemoteThread SetErrorMode WriteProcessMemory GlobalDeleteAtom DeviceIoControl FindClose DuplicateHandle MulDiv GetLocalTime FileTimeToLocalFileTime FileTimeToSystemTime FileTimeToDosDateTime PeekNamedPipe GetCPInfo GetThreadLocale SetThreadLocale GetUserDefaultLCID CreateToolhelp32Snapshot Process32First Process32Next Module32First Module32Next

oleaut32

SysAllocStringLen SysFreeString SysReAllocStringLen VariantChangeTypeEx VariantClear VariantCopy VariantInit SafeArrayAccessData SafeArrayCreate SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayRedim SafeArrayUnaccessData GetActiveObject

user32

MessageBoxA CharUpperBuffW CharLowerBuffW SendMessageA PostMessageA DefWindowProcA CallWindowProcA RegisterClassA UnregisterClassA GetClassInfoA CreateWindowExA SendDlgItemMessageA RegisterClipboardFormatA GetClipboardFormatNameA CharToOemA CharUpperA CharUpperBuffA CharLowerA CharLowerBuffA GetMenuItemInfoA SetPropA GetPropA RemovePropA EnumPropsA GetWindowLongA SetWindowLongA GetClassLongA SetClassLongA FindWindowA GetClassNameA LoadBitmapA LoadCursorA LoadIconA LoadImageA SystemParametersInfoA DispatchMessageW PeekMessageW SendMessageW PostMessageW DefWindowProcW CallWindowProcW RegisterClassW UnregisterClassW GetClassInfoW CreateWindowExW InsertMenuItemW GetMenuItemInfoW SetMenuItemInfoW DrawTextW DrawStateW SetWindowTextW GetWindowTextW GetWindowTextLengthW MessageBoxW GetWindowLongW SetWindowLongW DefFrameProcW DefMDIChildProcW TranslateMessage PostQuitMessage GetDoubleClickTime IsWindow IsMenu DestroyWindow ShowWindow ShowWindowAsync MoveWindow SetWindowPos GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsWindowVisible IsIconic BringWindowToTop IsZoomed GetDlgItem GetDialogBaseUnits OpenClipboard CloseClipboard SetClipboardData GetClipboardData CountClipboardFormats EnumClipboardFormats EmptyClipboard IsClipboardFormatAvailable SetFocus GetActiveWindow GetFocus GetKeyState GetAsyncKeyState mouse_event GetCapture SetCapture ReleaseCapture MsgWaitForMultipleObjects SetTimer KillTimer EnableWindow IsWindowEnabled GetSystemMetrics GetMenu SetMenu DrawMenuBar GetSystemMenu CreateMenu CreatePopupMenu DestroyMenu EnableMenuItem GetSubMenu GetMenuItemCount RemoveMenu DeleteMenu GetMenuItemRect UpdateWindow SetActiveWindow GetForegroundWindow SetForegroundWindow WindowFromDC GetDC GetDCEx GetWindowDC ReleaseDC BeginPaint EndPaint GetUpdateRect SetWindowRgn InvalidateRect InvalidateRgn RedrawWindow ScrollWindowEx ShowScrollBar EnableScrollBar GetClientRect GetWindowRect AdjustWindowRectEx MessageBeep SetCursorPos SetCursor GetCursorPos CreateCaret GetCaretBlinkTime DestroyCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen ScreenToClient MapWindowPoints WindowFromPoint GetSysColor GetSysColorBrush SetSysColors DrawFocusRect FillRect FrameRect SetRect InflateRect IntersectRect OffsetRect IsRectEmpty PtInRect GetDesktopWindow GetParent SetParent EnumWindows EnumThreadWindows GetTopWindow GetWindowThreadProcessId GetLastActivePopup GetWindow CallNextHookEx DestroyCursor DestroyIcon CopyImage CreateIconIndirect GetIconInfo SetScrollInfo GetScrollInfo TranslateMDISysAccel DrawEdge DrawFrameControl TrackPopupMenuEx ChildWindowFromPointEx DrawIconEx FlashWindowEx

advapi32

RegQueryInfoKeyA RegSetValueExW RegQueryValueExW RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegCloseKey RegFlushKey

gdi32

CreateFontIndirectA EnumFontFamiliesA GetCharABCWidthsA GetTextExtentPointA GetTextMetricsA GetObjectA ExtTextOutA CreateFontIndirectW EnumFontFamiliesExW GetCharABCWidthsW GetTextExtentPoint32W GetTextExtentExPointW GetObjectW TextOutW ExtTextOutW GetRandomRgn Arc BitBlt Chord CombineRgn CreateBitmap CreateBrushIndirect CreateCompatibleBitmap CreateCompatibleDC CreateDIBitmap CreateEllipticRgn CreatePen CreatePenIndirect CreatePatternBrush CreateRectRgn CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject Ellipse EqualRgn ExcludeClipRect ExtCreateRegion ExtFloodFill FillRgn GetROP2 GetBkColor GetBitmapBits GetClipBox GetClipRgn GetCurrentObject GetDeviceCaps GetDIBits GetMapMode GetObjectType GetPixel GetRegionData GetRgnBox GetStockObject GetTextAlign GetTextColor GetViewportExtEx GetViewportOrgEx GetWindowExtEx GetWindowOrgEx IntersectClipRect LineTo MaskBlt OffsetRgn PatBlt Pie PaintRgn PtInRegion RectInRegion RectVisible Rectangle RestoreDC RealizePalette RoundRect SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkColor SetBkMode SetMapMode SetPixel SetPolyFillMode StretchBlt SetRectRgn SetROP2 SetStretchBltMode SetTextCharacterExtra SetTextColor SetTextAlign CreateDIBSection SetArcDirection ExtCreatePen MoveToEx CreatePolygonRgn DPtoLP LPtoDP Polygon Polyline PolyBezier SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx SetBrushOrgEx GetDCOrgEx

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

shell32

DragQueryFileA ShellExecuteA DragQueryFileW DragFinish DragAcceptFiles SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW

ole32

CoTaskMemFree OleInitialize OleUninitialize CoUninitialize CoCreateInstance CLSIDFromProgID CoInitialize CoTaskMemAlloc GetErrorInfo

comctl32

InitCommonControls ImageList_Create ImageList_Destroy ImageList_GetImageCount ImageList_SetImageCount ImageList_Add ImageList_Replace ImageList_AddMasked ImageList_DrawEx ImageList_DrawIndirect ImageList_Remove ImageList_Copy ImageList_BeginDrag ImageList_EndDrag ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock _TrackMouseEvent

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringW ImmNotifyIME

comdlg32

ChooseColorA CommDlgExtendedError GetOpenFileNameW GetSaveFileNameW ChooseFontW

ws2_32

WSAStartup WSACleanup

wsock32

WSAStartup

ntdll

ZwQueryObject

wininet

InternetOpenA InternetCloseHandle InternetOpenUrlA InternetReadFile HttpQueryInfoA

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

145KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

a713964f539c1bce77b9f274efd10e4d75d3eaca0af5c02155559c8fd1d46275

kernel32

oleaut32

user32

advapi32

gdi32

version

shell32

ole32

comctl32

imm32

comdlg32

ws2_32

wsock32

ntdll

wininet

generic