Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2024 23:55
Behavioral task
behavioral1
Sample
aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exe
Resource
win7-20241010-en
General
-
Target
aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exe
-
Size
469KB
-
MD5
26e3842fd1b8d9392ca3b99c2454c380
-
SHA1
3d4c780451d786b627d5e22dd561efcae73239fd
-
SHA256
aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2ab
-
SHA512
f2b49c2512c8e23edad11c653f83fd274997c70a9d0354ce1715c3400ea725c166a60b8ce656fa502c360d78f25f077440fffaa45327f7339cd4c666edae483a
-
SSDEEP
6144:hqzOPI16UkWVs+QEoD/dL/4oSlCIqbKRs4EkfRDaPRrnVkWHQG:hqzIIUUvVs+IdMoSzqkR5RWVVWG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule C:\httnhb.exe family_blackmoon -
Executes dropped EXE 1 IoCs
Processes:
httnhb.exepid process 1176 httnhb.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1612 1176 WerFault.exe httnhb.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exehttnhb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exedescription pid process target process PID 2556 wrote to memory of 1176 2556 aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exe httnhb.exe PID 2556 wrote to memory of 1176 2556 aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exe httnhb.exe PID 2556 wrote to memory of 1176 2556 aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exe httnhb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exe"C:\Users\Admin\AppData\Local\Temp\aa27ccab35b2c6efe143c22907cfca3364f3fc5367bded59c73f2b9acba7f2abN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\httnhb.exec:\httnhb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 2923⤵
- Program crash
PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1176 -ip 11761⤵PID:3872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
469KB
MD5673136702f1491c52a2c4ce804bbad30
SHA12d15ef57d64821bc1d04952b67dd2a1f5a2be8c9
SHA2566b48bc1ee576f6d7a040128ffdf9ebed9a999d7cfa215a179b8863a7ed08a264
SHA512fe0332d473de8cb5b78e839f3c807c2a66729b16b8390c90e65c9c431b3b7ba6c01d90cdf28016cb947e186a1bca1dafd3dc2c2f111da7ff14dbc51da6b888b2