UgfqB_ZgaKJzU_YVgFq
Behavioral task
behavioral1
Sample
ee9d49d33f3f54472c911361bad43fe0ae038a6ac5d430e00c0ec74d1242e015.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ee9d49d33f3f54472c911361bad43fe0ae038a6ac5d430e00c0ec74d1242e015.dll
Resource
win10v2004-20240802-en
General
-
Target
ee9d49d33f3f54472c911361bad43fe0ae038a6ac5d430e00c0ec74d1242e015
-
Size
192KB
-
MD5
4a07516471a22262890a042acdb69701
-
SHA1
5ccde33eeb099ef8e9dd20bbbeea0a113458067f
-
SHA256
ee9d49d33f3f54472c911361bad43fe0ae038a6ac5d430e00c0ec74d1242e015
-
SHA512
041bb14a3548ab8213fa1c9ec1a4ee60dde59736f2b00a36b664ecfe1b66f84505fde910787a83930e095c9d794804c6cbd854dd7fcc2309a59b5e3902f7a7b0
-
SSDEEP
1536:ITw87kDJ5yuMzcnLYuzIcmt5Fd1unWP1dRZxUqPbIieIcOBqevm4KzVU+Cf:IT2AluFubrXtPbFlvv3KzVU+Q
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ee9d49d33f3f54472c911361bad43fe0ae038a6ac5d430e00c0ec74d1242e015
Files
-
ee9d49d33f3f54472c911361bad43fe0ae038a6ac5d430e00c0ec74d1242e015.dll windows:4 windows x86 arch:x86
9a6d9e33fda3e8fdd407ef20bb1cfbe6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LocalAlloc
LocalFree
Module32First
OpenProcess
QueryDosDeviceW
GetEnvironmentVariableA
VirtualAllocEx
VirtualProtectEx
WriteProcessMemory
ResumeThread
GetCurrentProcess
VirtualQueryEx
FreeLibrary
VirtualAlloc
VirtualFree
GetProcAddress
CloseHandle
RtlZeroMemory
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
CreateFileA
Sleep
ReadFile
GetFileSize
GetTickCount
GetCommandLineA
GetModuleFileNameA
LoadLibraryA
LCMapStringA
lstrcpynA
GetTempFileNameA
GetTempPathA
CreateProcessW
CopyFileA
MultiByteToWideChar
ExpandEnvironmentStringsW
CreateToolhelp32Snapshot
WideCharToMultiByte
RtlMoveMemory
GetCommandLineW
LockResource
WTSGetActiveConsoleSessionId
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
ProcessIdToSessionId
GetProcessHeap
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
shell32
ShellExecuteA
CommandLineToArgvW
advapi32
ChangeServiceConfig2A
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
RegQueryValueExA
RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserA
LookupAccountSidA
CryptDecrypt
iphlpapi
CreateIpForwardEntry
DeleteIpForwardEntry
GetIpForwardTable
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
psapi
GetProcessImageFileNameW
ws2_32
gethostbyname
WSACleanup
WSAStartup
msvcrt
modf
strstr
malloc
realloc
free
strchr
strrchr
floor
_stricmp
atof
sprintf
atoi
_ftol
oleaut32
VariantTimeToSystemTime
Exports
Exports
Sections
.text Size: 100KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ