Analysis
-
max time kernel
49s -
max time network
59s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/12/2024, 19:55
Behavioral task
behavioral1
Sample
3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe
Resource
win7-20240903-en
General
-
Target
3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe
-
Size
10.8MB
-
MD5
7e4bb3245fcd076f30d4a57da5b0ebf7
-
SHA1
c72a8bd2ac956ee2a950eb165b51fd9bbcbff385
-
SHA256
3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549
-
SHA512
838242b4c02bf91a06d386d27db96a714692b729102d1a64825a4de62bf1614ff118806b4b39e3dc25d8d150c49fc0a140c2a6073ad7a3cf5794cb3edd2cd04b
-
SSDEEP
196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 5 IoCs
resource yara_rule behavioral1/memory/2548-0-0x0000000000400000-0x0000000000CEB000-memory.dmp family_blackmoon behavioral1/memory/2548-4-0x0000000000400000-0x0000000000CEB000-memory.dmp family_blackmoon behavioral1/files/0x00090000000162e4-5.dat family_blackmoon behavioral1/memory/2680-9-0x0000000000400000-0x0000000000CEB000-memory.dmp family_blackmoon behavioral1/memory/2856-25-0x0000000000400000-0x0000000000466000-memory.dmp family_blackmoon -
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 4 IoCs
resource yara_rule behavioral1/memory/2548-0-0x0000000000400000-0x0000000000CEB000-memory.dmp mimikatz behavioral1/memory/2548-4-0x0000000000400000-0x0000000000CEB000-memory.dmp mimikatz behavioral1/files/0x00090000000162e4-5.dat mimikatz behavioral1/memory/2680-9-0x0000000000400000-0x0000000000CEB000-memory.dmp mimikatz -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts nwswlyt.exe -
Executes dropped EXE 3 IoCs
pid Process 2680 nwswlyt.exe 2304 nwswlyt.exe 2856 vdxmmfucrsaibcd18886.exe -
Loads dropped DLL 4 IoCs
pid Process 2056 cmd.exe 2056 cmd.exe 2304 nwswlyt.exe 2304 nwswlyt.exe -
Unexpected DNS network traffic destination 21 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 163.172.168.171 Destination IP 188.226.146.136 Destination IP 178.63.116.152 Destination IP 51.77.227.84 Destination IP 188.226.146.136 Destination IP 161.97.219.84 Destination IP 94.103.153.176 Destination IP 178.63.116.152 Destination IP 178.63.116.152 Destination IP 188.226.146.136 Destination IP 51.77.227.84 Destination IP 161.97.219.84 Destination IP 161.97.219.84 Destination IP 163.172.168.171 Destination IP 163.172.168.171 Destination IP 94.103.153.176 Destination IP 94.103.153.176 Destination IP 207.192.71.13 Destination IP 207.192.71.13 Destination IP 207.192.71.13 Destination IP 51.77.227.84 -
resource yara_rule behavioral1/files/0x000700000001660e-18.dat upx behavioral1/memory/2856-23-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2856-25-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\cygmthuq\nwswlyt.exe 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe File opened for modification C:\Windows\cygmthuq\nwswlyt.exe 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe File created C:\Windows\cygmthuq\vdxmmfucrsaibcd18886.exe nwswlyt.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nwswlyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nwswlyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2056 cmd.exe 1864 PING.EXE -
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x00090000000162e4-5.dat nsis_installer_2 -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1864 PING.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe 2856 vdxmmfucrsaibcd18886.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2548 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2548 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe Token: SeDebugPrivilege 2680 nwswlyt.exe Token: SeDebugPrivilege 2304 nwswlyt.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2548 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe 2680 nwswlyt.exe 2304 nwswlyt.exe 2856 vdxmmfucrsaibcd18886.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2056 2548 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe 30 PID 2548 wrote to memory of 2056 2548 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe 30 PID 2548 wrote to memory of 2056 2548 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe 30 PID 2548 wrote to memory of 2056 2548 3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe 30 PID 2056 wrote to memory of 1864 2056 cmd.exe 32 PID 2056 wrote to memory of 1864 2056 cmd.exe 32 PID 2056 wrote to memory of 1864 2056 cmd.exe 32 PID 2056 wrote to memory of 1864 2056 cmd.exe 32 PID 2056 wrote to memory of 2680 2056 cmd.exe 33 PID 2056 wrote to memory of 2680 2056 cmd.exe 33 PID 2056 wrote to memory of 2680 2056 cmd.exe 33 PID 2056 wrote to memory of 2680 2056 cmd.exe 33 PID 2304 wrote to memory of 2856 2304 nwswlyt.exe 36 PID 2304 wrote to memory of 2856 2304 nwswlyt.exe 36 PID 2304 wrote to memory of 2856 2304 nwswlyt.exe 36 PID 2304 wrote to memory of 2856 2304 nwswlyt.exe 36 PID 2304 wrote to memory of 2480 2304 nwswlyt.exe 37 PID 2304 wrote to memory of 2480 2304 nwswlyt.exe 37 PID 2304 wrote to memory of 2480 2304 nwswlyt.exe 37 PID 2304 wrote to memory of 2480 2304 nwswlyt.exe 37 PID 2480 wrote to memory of 2884 2480 cmd.exe 39 PID 2480 wrote to memory of 2884 2480 cmd.exe 39 PID 2480 wrote to memory of 2884 2480 cmd.exe 39 PID 2480 wrote to memory of 2884 2480 cmd.exe 39 PID 2304 wrote to memory of 2628 2304 nwswlyt.exe 40 PID 2304 wrote to memory of 2628 2304 nwswlyt.exe 40 PID 2304 wrote to memory of 2628 2304 nwswlyt.exe 40 PID 2304 wrote to memory of 2628 2304 nwswlyt.exe 40 PID 2628 wrote to memory of 300 2628 cmd.exe 42 PID 2628 wrote to memory of 300 2628 cmd.exe 42 PID 2628 wrote to memory of 300 2628 cmd.exe 42 PID 2628 wrote to memory of 300 2628 cmd.exe 42 PID 2304 wrote to memory of 2452 2304 nwswlyt.exe 43 PID 2304 wrote to memory of 2452 2304 nwswlyt.exe 43 PID 2304 wrote to memory of 2452 2304 nwswlyt.exe 43 PID 2304 wrote to memory of 2452 2304 nwswlyt.exe 43 PID 2452 wrote to memory of 1696 2452 cmd.exe 45 PID 2452 wrote to memory of 1696 2452 cmd.exe 45 PID 2452 wrote to memory of 1696 2452 cmd.exe 45 PID 2452 wrote to memory of 1696 2452 cmd.exe 45 PID 2304 wrote to memory of 1444 2304 nwswlyt.exe 46 PID 2304 wrote to memory of 1444 2304 nwswlyt.exe 46 PID 2304 wrote to memory of 1444 2304 nwswlyt.exe 46 PID 2304 wrote to memory of 1444 2304 nwswlyt.exe 46 PID 1444 wrote to memory of 2584 1444 cmd.exe 48 PID 1444 wrote to memory of 2584 1444 cmd.exe 48 PID 1444 wrote to memory of 2584 1444 cmd.exe 48 PID 1444 wrote to memory of 2584 1444 cmd.exe 48 PID 2304 wrote to memory of 2824 2304 nwswlyt.exe 49 PID 2304 wrote to memory of 2824 2304 nwswlyt.exe 49 PID 2304 wrote to memory of 2824 2304 nwswlyt.exe 49 PID 2304 wrote to memory of 2824 2304 nwswlyt.exe 49 PID 2824 wrote to memory of 2004 2824 cmd.exe 51 PID 2824 wrote to memory of 2004 2824 cmd.exe 51 PID 2824 wrote to memory of 2004 2824 cmd.exe 51 PID 2824 wrote to memory of 2004 2824 cmd.exe 51 PID 2304 wrote to memory of 2028 2304 nwswlyt.exe 52 PID 2304 wrote to memory of 2028 2304 nwswlyt.exe 52 PID 2304 wrote to memory of 2028 2304 nwswlyt.exe 52 PID 2304 wrote to memory of 2028 2304 nwswlyt.exe 52 PID 2028 wrote to memory of 2564 2028 cmd.exe 54 PID 2028 wrote to memory of 2564 2028 cmd.exe 54 PID 2028 wrote to memory of 2564 2028 cmd.exe 54 PID 2028 wrote to memory of 2564 2028 cmd.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe"C:\Users\Admin\AppData\Local\Temp\3399274e0046749cff555e46cf3d33437d235651cd94923e356b0d996cc53549.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\cygmthuq\nwswlyt.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1864
-
-
C:\Windows\cygmthuq\nwswlyt.exeC:\Windows\cygmthuq\nwswlyt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2680
-
-
-
C:\Windows\cygmthuq\nwswlyt.exeC:\Windows\cygmthuq\nwswlyt.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\cygmthuq\vdxmmfucrsaibcd18886.exeC:\Windows\cygmthuq\vdxmmfucrsaibcd18886.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2856
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 161.97.219.842⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 161.97.219.843⤵
- System Location Discovery: System Language Discovery
PID:2884
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 163.172.168.1712⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 163.172.168.1713⤵
- System Location Discovery: System Language Discovery
PID:300
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 94.103.153.1762⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 94.103.153.1763⤵
- System Location Discovery: System Language Discovery
PID:1696
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 207.192.71.132⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 207.192.71.133⤵
- System Location Discovery: System Language Discovery
PID:2584
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 178.63.116.1522⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 178.63.116.1523⤵
- System Location Discovery: System Language Discovery
PID:2004
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 51.77.227.842⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 51.77.227.843⤵
- System Location Discovery: System Language Discovery
PID:2564
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 188.226.146.1362⤵
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 188.226.146.1363⤵
- System Location Discovery: System Language Discovery
PID:764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD58a761ad0a469caa921b8a1bdb989b9d1
SHA14584c31d116e15f402cc17122edd304eb6c95b2e
SHA256875abc09f1abc43dfcc8a9c2a5e541c9a8bcaf33a4e8faa20c58947f8c8b56fa
SHA512d2e541a9a245ea883b54e06583c5db4532e042e333f633e9dc20a1fd5d8d11c46a283274bcde0f972234a63f95e518a27da50f34a1899d88a398bbeb76cb371f
-
Filesize
10.9MB
MD58e974e5dac1bd498ffbb10e8bd70f852
SHA1f601b92628f557d4dccaa6ad6b4a4328acd7db4f
SHA2560e3617450309f720be2ee115020e04f9399218b248d52fdb5675408d81642357
SHA51287a0a04f1370435496f7c84269c7b217c83eaef562e23b6a7f1cb5cae1cd1122d286fb6f09822fef90ced5bff728d38842a949c4dbac15d2d3bf776fb19c9eba