Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/11/2024, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe
Resource
win10v2004-20241007-en
General
-
Target
4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe
-
Size
6.9MB
-
MD5
c8672e21806c9bb816590e91cd36a0ea
-
SHA1
017599bcc927155437942032a9569bb1917fe728
-
SHA256
4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c
-
SHA512
a92c5cad91f884e62cf4618def7c35a35e9584adbce372a225c66d0db1dffe690ec0b4ccca1b8d681fde7d89d6a2207cf93b77212b07b4a7a6fdeb24c1f152a7
-
SSDEEP
98304:GM/ncLgcqtoFpOzxTKtAj3m+YcEjT9s9o36:3/nxtfotA7ycEjTC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/files/0x00060000000194ad-9.dat family_blackmoon -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 39x8hD6qVoR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\39x8hD6qVoR = "C:\\Users\\Admin\\AppData\\Roaming\\aokhn\\3NAv63Z_d9bKH0\\39x8hD6qVoR.exe" 39x8hD6qVoR.exe -
Executes dropped EXE 1 IoCs
pid Process 2708 39x8hD6qVoR.exe -
Loads dropped DLL 1 IoCs
pid Process 2708 39x8hD6qVoR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39x8hD6qVoR.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2708 39x8hD6qVoR.exe 2708 39x8hD6qVoR.exe 2708 39x8hD6qVoR.exe 2708 39x8hD6qVoR.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2708 39x8hD6qVoR.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2708 39x8hD6qVoR.exe 2708 39x8hD6qVoR.exe 2708 39x8hD6qVoR.exe 2708 39x8hD6qVoR.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2324 wrote to memory of 1832 2324 4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 31 PID 2324 wrote to memory of 1832 2324 4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 31 PID 2324 wrote to memory of 1832 2324 4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 31 PID 1832 wrote to memory of 2708 1832 4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 32 PID 1832 wrote to memory of 2708 1832 4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 32 PID 1832 wrote to memory of 2708 1832 4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 32 PID 1832 wrote to memory of 2708 1832 4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe"C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exeC:\Users\Admin\AppData\Local\Temp\4106de61a00c8e6b599cb74e7d30cc3304e283be19432b56d1721130dadfc37c.exe 45063C065A06530675066306740675065A06470662066B066F0668065A0647067606760642066706720667065A065406690667066B066F06680661065A06670669066D066E0668065A063506480647067006300635065C06590662063F0664064D064E0636065A0635063F067E063E066E06420630067706500669065406--aa`2⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Roaming\aokhn\3NAv63Z_d9bKH0\39x8hD6qVoR.exe"C:\Users\Admin\AppData\Roaming\aokhn\3NAv63Z_d9bKH0\39x8hD6qVoR.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2708
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146KB
MD5ae1817f4788e6733af457bd5dff46289
SHA132ba5f36e80c28f256204fa3abda0ab2774d8af8
SHA25608ccea61d93eb33675dffdeda73003d57b8f6710db4f9d98a5ec398a377101cd
SHA5126c73589e5b2a540fa116cf11f8871acd4b0c391a22f6adad28ac07b9144150762faf6153cde82a2b661f93d4b9c36a73aff5438ebe31515869e79a397a6d1d01
-
Filesize
493B
MD5d1a1666b76cf5e9d8bd4f19e37801225
SHA1e5bff206b78273c0b9fa12521915d1b66c0c6c2c
SHA256c4db940cd209c6f53e65ea5ae2171e80273b9ad7c7a8756d70a74fdda7b74019
SHA512c34b4c9e25adb903fe8c13a2e4841f5dbd666f5285559da21e1dbb4fdafe72154ac52d4e99d628de47744db4d73edd554c22184528001a4b29c284ae163ad6f2
-
Filesize
3.2MB
MD55f8ed487eb810823682db34b48e9dc2a
SHA16a71057639c8e2689285ae188bb24a0e9779d344
SHA2569c7117275638d9381bdb0ef53f589bd046bc43fb1f209c88763975804c13b55f
SHA5126f1d3894652f8f6de6bbc866aceba31957707960f2912f297a214c9e46b1be752f63370c4ae84e57182b4583898bdc6a9e673d84060398e6c9b2fe6feeb9626c