Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/11/2024, 04:36
Behavioral task
behavioral1
Sample
f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
General
- Target f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe
- Size 74KB
- Sample241110-e8bm8azfma
- SHA256 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896
- MD5 111ffdd7e36febe28e1e2eb6fb4ef3e0
- SHA1 d1ef2d1a9f0ffa1b08871c45c4d6773c377e37f8
- SHA512 65e7c0fc4d5614fc41be51114a55feaacc94b365c85677bf9a6ea523b776594afd0d29c729ac555d3963a8878595ffc296bb18f84826f6402d72db2cbd2c7313
- SSDEEP 1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8G:VfIS2vhLoz5sQkqgjg1YWZfoutG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/4592-14-0x0000000000400000-0x000000000046F000-memory.dmp family_blackmoon behavioral2/memory/4752-17-0x0000000000400000-0x000000000046F000-memory.dmp family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe - Deletes itself 1 IoCs
pid Process 4752 Syslemlsnck.exe - Executes dropped EXE 1 IoCs
pid Process 4752 Syslemlsnck.exe -
resource yara_rule behavioral2/memory/4592-0-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/files/0x00050000000230d8-9.dat upx behavioral2/memory/4592-14-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/4752-17-0x0000000000400000-0x000000000046F000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Syslemlsnck.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe 4752 Syslemlsnck.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4592 wrote to memory of 4752 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 94 PID 4592 wrote to memory of 4752 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 94 PID 4592 wrote to memory of 4752 4592 f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe"C:\Users\Admin\AppData\Local\Temp\f9a6f798a838f36329e963fe226d7b4db010dabd3c1a78427b58bc5f486ea896.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\Syslemlsnck.exe"C:\Users\Admin\AppData\Local\Temp\Syslemlsnck.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Syslemlsnck.exe
- Size 74KB
- SHA256 3f60d1acb7dd28eeaa73e1c09a5669fc505f858a432f8a9e24b3e1cfcba98743
- MD5 f9a541a88d903ee33fe70aeec8be63b7
- SHA1 65fd62da3cebc56c9c27c4bb4805ffd450009fec
- SHA512 e6043baa1a408d3653756a0c3d8e7c702f67749831ad95dc0b0862428799393a4672024a6c03a995fea1a1cbd8ad55bd187c6bb05cf0eb442f4ef05f8036d119
- SSDEEP 1536:IyfIcT9U1tPrgQvhLopacl1TsQk0NJP/PAjgas/3VUN0YWZPnouy8a:VfIS2vhLoz5sQkqgjg1YWZfouta
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\lpath.ini
- Size 102B
- SHA256 e0427fd700d451f201e684c8971781e38a6a2cc6cecb52ec15021e63a4a6d43b
- MD5 f20163c7ca72c152dab34ef813def8b4
- SHA1 a5504f688429bfeda28cc56a2e900fe50a8fb94c
- SHA512 8b841348f3dc4c746f95007cdaba1ae53bdd798391b03067a119357ce5c8eaa8d0e2ef5dab98ac5a239303a8a6f52fbe48b3682dafb5eff76c44e3d1121e9e96
- MD5 SHA1 SHA512