Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
86e3895a133458d777acc8d01371f6852fdb54218e5c8a19dbc99f8e3ef89291N.exe
Resource
win7-20240903-en
General
-
Target
86e3895a133458d777acc8d01371f6852fdb54218e5c8a19dbc99f8e3ef89291N.exe
-
Size
646KB
-
MD5
d46e001d2b16b5eee25993fb50f21a90
-
SHA1
75b8a42f6426dfc049ea43cc2ecc7783c87c2aa8
-
SHA256
86e3895a133458d777acc8d01371f6852fdb54218e5c8a19dbc99f8e3ef89291
-
SHA512
999507ec482630156c0b7243a6d0fbf5388b985148f8519b6e33142757f7526a6e4dd00ca0d7e93c6321c384581a7e2fe75d2701d0b9bc955272c041348af7f6
-
SSDEEP
12288:Vh5q30Ofm8xn3KpM5eQUq/4Zpdxy5p4SxHY502tKEysKxrrRkoYYQIsH+hEbyToS:/5UDm8xUceQUa4ZV84WY5lR8yfYxsH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/1740-2-0x0000000000400000-0x00000000006C4000-memory.dmp family_blackmoon -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86e3895a133458d777acc8d01371f6852fdb54218e5c8a19dbc99f8e3ef89291N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1740 86e3895a133458d777acc8d01371f6852fdb54218e5c8a19dbc99f8e3ef89291N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86e3895a133458d777acc8d01371f6852fdb54218e5c8a19dbc99f8e3ef89291N.exe"C:\Users\Admin\AppData\Local\Temp\86e3895a133458d777acc8d01371f6852fdb54218e5c8a19dbc99f8e3ef89291N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1740