Behavioral task
behavioral1
Sample
06570b8c1686836c22bdf08a5d2563e6649623652443d6ba7f72bfc5247f16bb.exe
Resource
win7-20240903-en
General
-
Target
06570b8c1686836c22bdf08a5d2563e6649623652443d6ba7f72bfc5247f16bb
-
Size
1.5MB
-
MD5
8ef6d50553968aa24534d144ca1c2b2b
-
SHA1
f635da263363c68a63e6014d0de35e8632e10108
-
SHA256
06570b8c1686836c22bdf08a5d2563e6649623652443d6ba7f72bfc5247f16bb
-
SHA512
82a071e9182eb23ada86d9c262b4d06bbc6e834cfd6bf769a859e4e17673d3f16e0579224ed770ce1df35b04f1a294bb6aa7dc5d179fedc891d54d9409404ff4
-
SSDEEP
24576:ojd6eR0wROPYzygsEP38vapE/f0KYXbonpgW0xk:owP8ygsEkCpEXYUpgW0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06570b8c1686836c22bdf08a5d2563e6649623652443d6ba7f72bfc5247f16bb
Files
-
06570b8c1686836c22bdf08a5d2563e6649623652443d6ba7f72bfc5247f16bb.exe windows:4 windows x86 arch:x86
af53ebeaee4e95e7cef28e7564bf3611
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
GetModuleHandleA
LoadLibraryA
GetProcAddress
VirtualFree
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LCMapStringA
FreeLibrary
GetCommandLineA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
DeleteFileA
SetStdHandle
IsBadCodePtr
CloseHandle
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
TerminateProcess
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
FlushFileBuffers
GetCurrentProcess
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
SetLastError
InterlockedIncrement
lstrcpyA
lstrcatA
WritePrivateProfileStringA
InterlockedDecrement
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
SetFilePointer
WriteFile
GetTickCount
CreateFileA
GetFileSize
ReadFile
GetUserDefaultLCID
GetPrivateProfileStringA
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
RtlZeroMemory
lstrcmpiW
lstrcmpW
lstrlenW
GetSystemInfo
LocalSize
GlobalReAlloc
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
LocalFree
LocalAlloc
lstrlenA
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
WriteProcessMemory
OpenProcess
GlobalSize
CreateThread
lstrcpynA
GetCurrentProcessId
MulDiv
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
RtlMoveMemory
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetModuleHandleW
atl
ord47
ord11
ord10
ord42
user32
CallWindowProcA
LoadIconW
PostQuitMessage
MessageBoxW
BeginPaint
PeekMessageA
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuItemInfoW
GetMenuStringW
TrackPopupMenu
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuW
GetMenuItemCount
AppendMenuW
DestroyMenu
LoadMenuW
GetSystemMenu
CreatePopupMenu
CreateMenu
CharLowerW
CharUpperW
DrawTextW
wvsprintfA
RegisterClassExW
SetForegroundWindow
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageW
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetSysColor
FillRect
SetClassLongW
GetClassLongW
SetRect
SetWindowRgn
DestroyCursor
EndPaint
CallWindowProcW
GetAsyncKeyState
PostMessageA
SendMessageA
GetWindowLongA
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
GetWindowThreadProcessId
GetKeyState
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
GetClassNameA
PtInRect
GetDlgCtrlID
GetWindow
ClientToScreen
SetWindowTextA
GetWindowTextA
UnhookWindowsHookEx
SetWindowLongA
TabbedTextOutA
DrawTextA
GetAncestor
SendDlgItemMessageA
IsDialogMessageA
GetWindowPlacement
SystemParametersInfoA
RegisterWindowMessageA
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
SetActiveWindow
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
CreateDialogIndirectParamA
EndDialog
GetClientRect
DestroyWindow
DefWindowProcW
SendMessageW
DefMDIChildProcW
LoadCursorW
SetCursor
TrackMouseEvent
DestroyIcon
SetWindowLongW
CreateWindowExW
GetWindowLongW
GetDlgItem
SetFocus
GetFocus
GetWindowRect
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
MoveWindow
SetWindowPos
PostMessageW
SetParent
EnumWindows
ReleaseDC
GetDC
CopyIcon
CopyImage
CreateIconFromResource
GetClassNameW
IsWindow
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetParent
GetMessageW
GrayStringA
CallNextHookEx
RemovePropW
GetPropW
SetPropW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
EnableWindow
IsWindowEnabled
ShowWindow
IsWindowVisible
ole32
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
OleFlushClipboard
OleIsCurrentClipboard
CLSIDFromString
CreateStreamOnHGlobal
OleRun
CLSIDFromProgID
CoRevokeClassObject
CoCreateInstance
oleaut32
OleLoadPicture
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantClear
SysAllocString
VariantCopy
SafeArrayDestroy
VariantInit
VariantChangeType
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
gdi32
FrameRgn
SetBkMode
SetTextColor
FillRgn
CreateCompatibleBitmap
CreatePatternBrush
CreateSolidBrush
CreateRoundRectRgn
CombineRgn
ExtCreateRegion
BitBlt
SelectObject
DeleteDC
CreateDIBSection
GetObjectA
GetStockObject
DeleteObject
CreateDCA
StretchBlt
CreateCompatibleDC
GetDeviceCaps
SetBkColor
CreateBitmap
SaveDC
RestoreDC
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
ScaleWindowExtEx
shell32
DragFinish
Shell_NotifyIconW
ShellExecuteEx
DragAcceptFiles
DragQueryFileW
SHGetSpecialFolderPathA
shlwapi
PathFileExistsA
StrTrimW
StrToIntExA
PathFindExtensionA
psapi
GetProcessMemoryInfo
wininet
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetGetConnectedState
HttpQueryInfoA
comctl32
ord17
InitCommonControlsEx
dbghelp
MakeSureDirectoryPathExists
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
oledlg
ord8
Sections
.text Size: 284KB - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE