Behavioral task
behavioral1
Sample
6c6eb7a7deb590c4dfd035a8d44bc1fb67a12196bdc0e834fc7bbc6bc9507dd1N.exe
Resource
win7-20240903-en
General
-
Target
6c6eb7a7deb590c4dfd035a8d44bc1fb67a12196bdc0e834fc7bbc6bc9507dd1N
-
Size
37KB
-
MD5
f6bae748cc2161e3ee813c93ed316f50
-
SHA1
ec06282862e0d21e80d948084a42d450cb6eb95a
-
SHA256
6c6eb7a7deb590c4dfd035a8d44bc1fb67a12196bdc0e834fc7bbc6bc9507dd1
-
SHA512
84373766ebb023042ee2a5ade253eda7133bcdddcb355287ee0bf5cb536009cfa9c59ec0f6961cf214bd7e424ac3e9b087d74e222eaf6a5439bfa60592ad4031
-
SSDEEP
768:KNZ47Rf7KKtpJBoldeozwBBKOEB+WnZNWDKUqxVha5+:Kf0tdolcIO7WnZNWWUOD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6c6eb7a7deb590c4dfd035a8d44bc1fb67a12196bdc0e834fc7bbc6bc9507dd1N
Files
-
6c6eb7a7deb590c4dfd035a8d44bc1fb67a12196bdc0e834fc7bbc6bc9507dd1N.exe windows:4 windows x86 arch:x86
c4a7fc3a2fb6cb2e481b90c5456b4e07
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
TerminateProcess
CreateWaitableTimerA
SetWaitableTimer
CreateDirectoryA
MoveFileA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetFileSize
CreateFileA
GetModuleFileNameA
CreateProcessA
GetStartupInfoA
GetEnvironmentVariableA
CopyFileA
WriteFile
Process32Next
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
Process32First
CreateToolhelp32Snapshot
lstrcpyn
OpenProcess
GetCurrentProcessId
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetTickCount
user32
SetTimer
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
MessageBoxA
wsprintfA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
msvcrt
_ftol
strncpy
tolower
strchr
atoi
modf
strncmp
memmove
??3@YAXPAX@Z
strrchr
??2@YAPAXI@Z
sprintf
shlwapi
PathFileExistsA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE