Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
21/10/2024, 09:06
Behavioral task
behavioral1
Sample
3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
- Target 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe
- Size 80KB
- Sample241021-k2saaaxfqa
- SHA256 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780e
- MD5 19bd0ab98f118b10d3a93a7f21f62e60
- SHA1 4581de3c893b5efb8c1ea2f173a0c0bba74b74d1
- SHA512 1d6e7dd0528ebfd9700a2a79c0a2c4ce35f1d4513883df7f8e4fb99d4b66e642ef89a4ae7f9bfa3da0e8f0923e202a4458cef2071c049408485fa5124331551b
- SSDEEP 1536:+VtjAKqURk0Ex/tIWLSYGc5cmFF+TTdGka2dQe5GrpXLaA:CN1qURFY/RLSO5cmFY9GMdKGA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/3496-14-0x0000000000400000-0x000000000046B000-memory.dmp family_blackmoon behavioral2/memory/1936-16-0x0000000000400000-0x000000000046B000-memory.dmp family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe - Deletes itself 1 IoCs
pid Process 1936 Systemiihjn.exe - Executes dropped EXE 1 IoCs
pid Process 1936 Systemiihjn.exe -
resource yara_rule behavioral2/memory/3496-0-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/files/0x000c000000023b88-9.dat upx behavioral2/memory/3496-14-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/1936-16-0x0000000000400000-0x000000000046B000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Systemiihjn.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe 1936 Systemiihjn.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3496 wrote to memory of 1936 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 95 PID 3496 wrote to memory of 1936 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 95 PID 3496 wrote to memory of 1936 3496 3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe"C:\Users\Admin\AppData\Local\Temp\3d8d82b894a0f046f6753ea196a760c8aa6c1db9abd4ee056cd769296528780eN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\Systemiihjn.exe"C:\Users\Admin\AppData\Local\Temp\Systemiihjn.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Systemiihjn.exe
- Size 81KB
- SHA256 6b4cc53c37a7acc027d1e49dd58b3ddabce2d132d1cf18af73f4cac475297228
- MD5 f19ea7e018fc208e7f1aee349007a925
- SHA1 cd3635efb1fd9292a3f2305ed766c4c8560a5971
- SHA512 b6e57829e06c98d69de05cabe81550b6d064b6ec3b7cc4eceb0198f266154be8ae480511b4e0cc4a83151ad4689fa731bb62048951cc6c5a5408b18100a1a6c6
- SSDEEP 1536:+VtjAKqURk0Ex/tIWLSYGc5cmFF+TTdGka2dQe5GrpXLaT:CN1qURFY/RLSO5cmFY9GMdKGT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\fpath.ini
- Size 103B
- SHA256 31c3c934d0ea9ef68b7749174972747ec3e230b432411db12781982911f29ac2
- MD5 1a38e0d64ddc8ae8b58ad3719e6e875e
- SHA1 8212d04ad91919314f5076bf3ad56b1f4d57e0af
- SHA512 e1ba0e2be5604f2194e7fe3eb846afd9e88dc69092772cfe1f60f6c0fe23b2e7d41173b3dfc14acf515d98fea81e7af85a779b014c51a22ec484ca850a4c9a27
- MD5 SHA1 SHA512