Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 12:44
Static task
static1
Behavioral task
behavioral1
Sample
946de660784fde74475ede41141fba51804204d7ba7746a1be1c855653543f40.exe
Resource
win7-20240903-en
General
-
Target
946de660784fde74475ede41141fba51804204d7ba7746a1be1c855653543f40.exe
-
Size
697KB
-
MD5
04082b130a9aa8dd679460ba4b34b0fd
-
SHA1
7a5bdba9081959088901fe870bec72f9a695f8d3
-
SHA256
946de660784fde74475ede41141fba51804204d7ba7746a1be1c855653543f40
-
SHA512
38650f26723adc9b45e0306615788fc8709cc041e5070c67d4acc7d4914db16fce713605057dc652be3726624b5f897d8b6ace4fe7219502eb944fa030e31c8c
-
SSDEEP
12288:nm9aPTBtTPFhlpkHucok7CqetwIvzScrybBmMAO1Do6Cp/ZUylmkRaWpQuUGC16m:7BtTPFLpkHOjPwIv9y/ddyl5RaemyA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/1044-1-0x0000000000400000-0x00000000006EA000-memory.dmp family_blackmoon -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 946de660784fde74475ede41141fba51804204d7ba7746a1be1c855653543f40.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1044 946de660784fde74475ede41141fba51804204d7ba7746a1be1c855653543f40.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\946de660784fde74475ede41141fba51804204d7ba7746a1be1c855653543f40.exe"C:\Users\Admin\AppData\Local\Temp\946de660784fde74475ede41141fba51804204d7ba7746a1be1c855653543f40.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1044