Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 18:41
Behavioral task
behavioral1
Sample
c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe
Resource
win7-20240903-en
General
-
Target
c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe
-
Size
73KB
-
MD5
0beb9c4cf55707358a5e5c2e1b77641a
-
SHA1
f02072332c430f92020668f2341bb8dd4ebbac4e
-
SHA256
c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95
-
SHA512
bb3d70e4f26336b1d672f931c3552148c667fccf4197f16f6702cb1c3e542e19899236c448e4f85bac4f2e6d4f57ac329d8d41eb003d5dcb1f9af2f2c5cd21ce
-
SSDEEP
1536:9VFF9aowJ5k3YkrQNSUgx9g038nUyho8P8Ox6DR9hCoQZuj5oLk01JT:Xv9aowc3YYeeWUyH8OyzCoQZq5ox
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/2588-11-0x0000000000400000-0x0000000000447000-memory.dmp family_blackmoon behavioral2/memory/2588-35-0x0000000000400000-0x0000000000447000-memory.dmp family_blackmoon -
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatalrat family
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/4736-30-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 2692 spower.exe 4736 svchost.exe -
resource yara_rule behavioral2/files/0x0007000000023ca4-14.dat vmprotect behavioral2/memory/2692-18-0x00007FF69C100000-0x00007FF69C6AC000-memory.dmp vmprotect behavioral2/memory/2692-21-0x00007FF69C100000-0x00007FF69C6AC000-memory.dmp vmprotect behavioral2/memory/2692-24-0x00007FF69C100000-0x00007FF69C6AC000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHTASKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5004 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2692 spower.exe 2692 spower.exe 2692 spower.exe 2692 spower.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2692 spower.exe Token: SeDebugPrivilege 4736 svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2588 wrote to memory of 2692 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 82 PID 2588 wrote to memory of 2692 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 82 PID 2692 wrote to memory of 792 2692 spower.exe 10 PID 2692 wrote to memory of 792 2692 spower.exe 10 PID 2692 wrote to memory of 792 2692 spower.exe 10 PID 2588 wrote to memory of 4736 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 83 PID 2588 wrote to memory of 4736 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 83 PID 2588 wrote to memory of 4736 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 83 PID 2588 wrote to memory of 5004 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 84 PID 2588 wrote to memory of 5004 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 84 PID 2588 wrote to memory of 5004 2588 c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe 84
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe"C:\Users\Admin\AppData\Local\Temp\c9c434da4c867be554dc901bc1bdc4a644872762cfa8dcedce1b8f9ab6233c95.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\vn5ogyx02giz6kl\spower.exeC:\Users\Admin\AppData\Local\Temp\vn5ogyx02giz6kl\spower.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
-
-
C:\ProgramData\NVIDIARV\svchost.exeC:\ProgramData\NVIDIARV\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Picturesvn5ogyx0\CCCef3Render.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5c42379ca208a33e2496ea4f5da6c9f24
SHA1f0dc893080344a1873f84ee7221d5aa08a480e4a
SHA2563106d03a8d2451396f2d799001e87d4f5393d58028f142c763356e20be9fbaf4
SHA51273e5beb73a3ee9ca82cbe740d9ed84c7a03d3f0fb3b707273f7e93c22a09e1a0ac6ff9e353651c906dd608faff09c0c395eda4c7a213a15d164f1024b4580186
-
Filesize
2.7MB
MD5ac30909929056007eaf0fbcf53c3a21f
SHA17046d48c84748b246ebaa1c0153e8f81d3b0acc1
SHA256f11baf3657a9bbfeb5d140a37d456573f589212447446a1519033ad010b9f58f
SHA51271a40652f3cdfbd33cfc539855d6cbb1fba601e83bbd4b3e4f5e397144b3abfed5d148b486aec4eec17136e063609f93beae72a5e78d12d876dd79ccd3c9c849