Analysis
- max time kernel
119s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 21:34
Behavioral task
behavioral1
Sample
64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe
Resource
win7-20241023-en
windows7-x64
11 signatures
120 seconds
General
- Target 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe
- Size 88KB
- Sample241109-1e8lrasglc
- SHA256 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0f
- MD5 75f6d0863818f417cdf924c4ac3cf930
- SHA1 cdde19b9978ede16b02db1cf4ac0039787ce7a63
- SHA512 3f5c718001d2189ffbf444e87318b17bab3676451131b20e970f55fac2769919fbf876b0ad68988bcf750f4fc266a1c0207c72b8545ecccd15cb19e267fc6e73
- SSDEEP 1536:D3ScSeuCQ5CvP3ErbK0GsA1Irn6ykkXERklFceLnFaswUemjmh5WGiirTb9Qyzz:DSleucPUXKhsmIGZkXYUJFg5fRiaTRj
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/852-14-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon behavioral2/memory/2944-16-0x0000000000400000-0x000000000047E000-memory.dmp family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe - Deletes itself 1 IoCs
pid Process 2944 Systemngera.exe - Executes dropped EXE 1 IoCs
pid Process 2944 Systemngera.exe -
resource yara_rule behavioral2/memory/852-0-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/files/0x000b00000001e582-9.dat upx behavioral2/memory/852-14-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral2/memory/2944-16-0x0000000000400000-0x000000000047E000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Systemngera.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe 2944 Systemngera.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 852 wrote to memory of 2944 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 93 PID 852 wrote to memory of 2944 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 93 PID 852 wrote to memory of 2944 852 64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe"C:\Users\Admin\AppData\Local\Temp\64184f46e574659ad8c15cf023c56e7e05dd1b37f06ddfa0a93ebb0e74804d0fN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\Systemngera.exe"C:\Users\Admin\AppData\Local\Temp\Systemngera.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Systemngera.exe
- Size 88KB
- SHA256 8c1e7d58f648e7f4bdea82b3822ffe85192d322ad3eec4978e0199a19fe33250
- MD5 d18a1d12e01f5ad7a6e80590a381a6c3
- SHA1 8e556933521e011829ab92587dbf46dd6cd01262
- SHA512 35eb1434863d4084087e262d80505ce0983ec61e0fa1f6235552e36ffa8fdf956a7535102c6b025f4963fbbb850d7205145e3603fff0507f9e8595c9bdd6d13b
- SSDEEP 1536:D3ScSeuCQ5CvP3ErbK0GsA1Irn6ykkXERklFceLnFaswUemjmh5WGiirTb9QyzR:DSleucPUXKhsmIGZkXYUJFg5fRiaTRB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\path.ini
- Size 103B
- SHA256 19c43aed1f8963b48ca6e1d1aa51834c9486ff6257f5414405b715b291a653e7
- MD5 6ff171c974fa0e91d9ad0505c02f9b0e
- SHA1 c26b244c5adbe56d32c68a11f7611f2e336c17ed
- SHA512 0db0a45f6b775f92abaa6f2f62a220e6fed516c00e18c0dee56c32124ca86ca4659a83fc51291ed3b2a36bd93101fa876310682c2c231d450ed1b609003fa3a3
- MD5 SHA1 SHA512