Analysis
-
max time kernel
141s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 12:44
Static task
static1
Behavioral task
behavioral1
Sample
9ad0ec92c8388054e07ac55dadae32e23228579cd7cfb0fc9d6615f7846a0e4b.exe
Resource
win7-20240729-en
General
-
Target
9ad0ec92c8388054e07ac55dadae32e23228579cd7cfb0fc9d6615f7846a0e4b.exe
-
Size
664KB
-
MD5
db56a7ade11708c6cb79fd9c1a331757
-
SHA1
bd9775ee6a254b7a2b6f55097a8f7ce3043bbcff
-
SHA256
9ad0ec92c8388054e07ac55dadae32e23228579cd7cfb0fc9d6615f7846a0e4b
-
SHA512
7e34fcb5409ca4cfb8a86ad5d7421a753657736ad03a6ff33a533021ff5df05effd25b7841cb5f653f0b3b523e4928422084bb2f51309d7c2af1ae10eee9c0bf
-
SSDEEP
12288:RFF/RLZausUzaSeWydNWLYMTVZH+DQHEfBnmH8r7sfkr/nVBl1eAuDom4VKg6ckt:RXmUzEWEMTHHkQHEpmH8/sfkr/VBl1ex
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/2296-1-0x0000000000400000-0x00000000006DC000-memory.dmp family_blackmoon -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ad0ec92c8388054e07ac55dadae32e23228579cd7cfb0fc9d6615f7846a0e4b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2296 9ad0ec92c8388054e07ac55dadae32e23228579cd7cfb0fc9d6615f7846a0e4b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ad0ec92c8388054e07ac55dadae32e23228579cd7cfb0fc9d6615f7846a0e4b.exe"C:\Users\Admin\AppData\Local\Temp\9ad0ec92c8388054e07ac55dadae32e23228579cd7cfb0fc9d6615f7846a0e4b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2296