Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 04:40
Static task
static1
Behavioral task
behavioral1
Sample
8fee3cec2edc7b3801f8f853fe6007a42c3558e59b1ef95d3f110d5fc1c378ae.exe
Resource
win7-20240903-en
General
-
Target
8fee3cec2edc7b3801f8f853fe6007a42c3558e59b1ef95d3f110d5fc1c378ae.exe
-
Size
1.7MB
-
MD5
134b3982bc07174a729a04dac616421c
-
SHA1
713def15d840ca9570720c1799ef65f1bd02d6bc
-
SHA256
8fee3cec2edc7b3801f8f853fe6007a42c3558e59b1ef95d3f110d5fc1c378ae
-
SHA512
7ea025c2996502b99e8fc8c072d5ec53fe9715fe57b3784c22fbd8726ddd216394b5e90b66f70e7c6e5e6e91aca842dd9aee0629acf0fe9d2616ddeeda35ebd6
-
SSDEEP
24576:1crKyxATxR99HXWxQeY6ehQMGVoKegLRxFBok826IqB5cnaDmB/5rTtTkmv:RrcElGSKegLbjo3iqIaqNtIm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/2672-2-0x0000000000400000-0x0000000000655000-memory.dmp family_blackmoon -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8fee3cec2edc7b3801f8f853fe6007a42c3558e59b1ef95d3f110d5fc1c378ae.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2672 8fee3cec2edc7b3801f8f853fe6007a42c3558e59b1ef95d3f110d5fc1c378ae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fee3cec2edc7b3801f8f853fe6007a42c3558e59b1ef95d3f110d5fc1c378ae.exe"C:\Users\Admin\AppData\Local\Temp\8fee3cec2edc7b3801f8f853fe6007a42c3558e59b1ef95d3f110d5fc1c378ae.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2672