Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 18:41
Behavioral task
behavioral1
Sample
c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe
Resource
win7-20240903-en
General
-
Target
c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe
-
Size
73KB
-
MD5
0beb9c4cf55707358a5e5c2e1b77641a
-
SHA1
f02072332c430f92020668f2341bb8dd4ebbac4e
-
SHA256
c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95
-
SHA512
bb3d70e4f26336b1d672f931c3552148c667fccf4197f16f6702cb1c3e542e19899236c448e4f85bac4f2e6d4f57ac329d8d41eb003d5dcb1f9af2f2c5cd21ce
-
SSDEEP
1536:9VFF9aowJ5k3YkrQNSUgx9g038nUyho8P8Ox6DR9hCoQZuj5oLk01JT:Xv9aowc3YYeeWUyH8OyzCoQZq5ox
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral1/memory/2092-19-0x0000000000400000-0x0000000000447000-memory.dmp family_blackmoon behavioral1/memory/2092-39-0x0000000000400000-0x0000000000447000-memory.dmp family_blackmoon behavioral1/memory/2092-54-0x0000000000400000-0x0000000000447000-memory.dmp family_blackmoon -
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatalrat family
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral1/memory/2756-49-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 2624 spower.exe 2756 svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe -
resource yara_rule behavioral1/files/0x0006000000018d7b-22.dat vmprotect behavioral1/memory/2624-38-0x000000013FA60000-0x000000014000C000-memory.dmp vmprotect behavioral1/memory/2624-36-0x000000013FA60000-0x000000014000C000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHTASKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 236 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2624 spower.exe 2624 spower.exe 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2624 spower.exe Token: SeDebugPrivilege 2756 svchost.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2624 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 31 PID 2092 wrote to memory of 2624 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 31 PID 2092 wrote to memory of 2624 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 31 PID 2092 wrote to memory of 2624 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 31 PID 2624 wrote to memory of 604 2624 spower.exe 9 PID 2092 wrote to memory of 2756 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 32 PID 2092 wrote to memory of 2756 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 32 PID 2092 wrote to memory of 2756 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 32 PID 2092 wrote to memory of 2756 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 32 PID 2092 wrote to memory of 236 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 33 PID 2092 wrote to memory of 236 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 33 PID 2092 wrote to memory of 236 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 33 PID 2092 wrote to memory of 236 2092 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 33
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe"C:\Users\Admin\AppData\Local\Temp\c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\ockhi063vqdbh49\spower.exeC:\Users\Admin\AppData\Local\Temp\ockhi063vqdbh49\spower.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
-
-
C:\ProgramData\NVIDIARV\svchost.exeC:\ProgramData\NVIDIARV\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Picturesockhi063\CCCef3Render.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5c42379ca208a33e2496ea4f5da6c9f24
SHA1f0dc893080344a1873f84ee7221d5aa08a480e4a
SHA2563106d03a8d2451396f2d799001e87d4f5393d58028f142c763356e20be9fbaf4
SHA51273e5beb73a3ee9ca82cbe740d9ed84c7a03d3f0fb3b707273f7e93c22a09e1a0ac6ff9e353651c906dd608faff09c0c395eda4c7a213a15d164f1024b4580186
-
Filesize
2.7MB
MD5ac30909929056007eaf0fbcf53c3a21f
SHA17046d48c84748b246ebaa1c0153e8f81d3b0acc1
SHA256f11baf3657a9bbfeb5d140a37d456573f589212447446a1519033ad010b9f58f
SHA51271a40652f3cdfbd33cfc539855d6cbb1fba601e83bbd4b3e4f5e397144b3abfed5d148b486aec4eec17136e063609f93beae72a5e78d12d876dd79ccd3c9c849