Analysis
-
max time kernel
140s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 06:58
Static task
static1
Behavioral task
behavioral1
Sample
a897d71c931c5a1bbb56be6808d62a630659142c9e8f96ad84e5a07cfc524e99.exe
Resource
win7-20240729-en
General
-
Target
a897d71c931c5a1bbb56be6808d62a630659142c9e8f96ad84e5a07cfc524e99.exe
-
Size
696KB
-
MD5
f0e617be50b93da2ed30831bcaef1fb8
-
SHA1
0f6895c0fa54256de0a2b93d6e3933837a166ef6
-
SHA256
a897d71c931c5a1bbb56be6808d62a630659142c9e8f96ad84e5a07cfc524e99
-
SHA512
db0378fa4bd9326bd1761b9db12eed28d814ebb81e5708a2c13c193d94c9028b2b3b7464dd23c298deee01382338d766f138f6907466f7c576f250e8e52fbdcc
-
SSDEEP
12288:u5b5+2L7vydj9BeRKJ6pBWnlEkl8bTQoLUnoN8EuBjaCCZH3wzfGNCRZT+oS:5A+dj9Bo0dl83hLUn1EuBjCZ+G
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/2296-1-0x0000000000400000-0x00000000006EC000-memory.dmp family_blackmoon -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a897d71c931c5a1bbb56be6808d62a630659142c9e8f96ad84e5a07cfc524e99.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2296 a897d71c931c5a1bbb56be6808d62a630659142c9e8f96ad84e5a07cfc524e99.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a897d71c931c5a1bbb56be6808d62a630659142c9e8f96ad84e5a07cfc524e99.exe"C:\Users\Admin\AppData\Local\Temp\a897d71c931c5a1bbb56be6808d62a630659142c9e8f96ad84e5a07cfc524e99.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2296