Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-10-2024 23:45
Behavioral task
behavioral1
Sample
a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exe
Resource
win7-20240903-en
General
-
Target
a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exe
-
Size
3.8MB
-
MD5
606b97ece0952eaa2da4cffa96e1fab0
-
SHA1
12054550a8c1fc0bd9458d82abc2a0d93286fd5e
-
SHA256
a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fc
-
SHA512
13c271574f6c647eb9065b2ab20290aa60fb76f61b0c12162ffecf9eb784e6c65d48d6d2a573c8de981b27dd692ee8ce5c8e5d072b6c8d76501bad7f3ca43b01
-
SSDEEP
49152:IsCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98F:76XLq/qPPslzKx/dJg1ErmNC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2888-3-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon C:\rlrxlrx.exe family_blackmoon behavioral1/memory/2888-8-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 1 IoCs
Processes:
rlrxlrx.exepid process 1720 rlrxlrx.exe -
Processes:
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2888-3-0x0000000000220000-0x0000000000248000-memory.dmp upx C:\rlrxlrx.exe upx behavioral1/memory/2888-8-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2348 1720 WerFault.exe rlrxlrx.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exerlrxlrx.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxlrx.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exerlrxlrx.exedescription pid process target process PID 2888 wrote to memory of 1720 2888 a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exe rlrxlrx.exe PID 2888 wrote to memory of 1720 2888 a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exe rlrxlrx.exe PID 2888 wrote to memory of 1720 2888 a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exe rlrxlrx.exe PID 2888 wrote to memory of 1720 2888 a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exe rlrxlrx.exe PID 1720 wrote to memory of 2348 1720 rlrxlrx.exe WerFault.exe PID 1720 wrote to memory of 2348 1720 rlrxlrx.exe WerFault.exe PID 1720 wrote to memory of 2348 1720 rlrxlrx.exe WerFault.exe PID 1720 wrote to memory of 2348 1720 rlrxlrx.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exe"C:\Users\Admin\AppData\Local\Temp\a3779fc0e5cc0845faab56b3bd00bcc4dfbc289ba8f645d4d4fc4ae6834248fcN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rlrxlrx.exec:\rlrxlrx.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 363⤵
- Program crash
PID:2348
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD50f742ae47c8aa44ed0781fe4305f3154
SHA1bcd3b59a305d2cc7dd42cfb1c03a6527c70f8966
SHA256c3dafcaab62b8795c63f43bcc5e206f21ef3098855665731529dd40ff5da5aad
SHA51298a1ff7f77d85fe65108fafc75d498faf97b839d7a5efdd0ed6b94ae6b32e1607d09f46d87d4f53e2fb2b21502c94590810e47b412c4887b3f10b567ebb3ae7a