Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2024 15:41
Behavioral task
behavioral1
Sample
4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe
Resource
win7-20240903-en
General
-
Target
4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe
-
Size
74KB
-
MD5
46d85a24ab5d5435e1ac054fd9514d9e
-
SHA1
1d81c7986bc5f47078e50b2f41668eb16ec2bb15
-
SHA256
4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da
-
SHA512
951660395cee249aca77953c34d4af015ab8bb0ba0a7ccfc15f4a6033dfb0b182d667988da0c16e4a9af0744deaa6b64e5f07a7ab6aa47f1ed948ccbe512a35d
-
SSDEEP
1536:Ow3g1JoEokN7SdJUsl9Uy90kEdms6DR9hCoQZuj5oLrWLL:r3gPodk1SdJUIR9RKmtzCoQZq5og
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral2/memory/4784-1-0x0000000000400000-0x0000000000447000-memory.dmp family_blackmoon behavioral2/memory/4784-2-0x0000000000400000-0x0000000000447000-memory.dmp family_blackmoon behavioral2/memory/4784-13-0x0000000000400000-0x0000000000447000-memory.dmp family_blackmoon behavioral2/memory/4784-38-0x0000000000400000-0x0000000000447000-memory.dmp family_blackmoon -
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatalrat family
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/4996-32-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 2548 spower.exe 4996 svchost.exe -
resource yara_rule behavioral2/files/0x000a000000023b83-16.dat vmprotect behavioral2/memory/2548-26-0x00007FF7968C0000-0x00007FF796E6C000-memory.dmp vmprotect behavioral2/memory/2548-23-0x00007FF7968C0000-0x00007FF796E6C000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHTASKS.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2248 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 2548 spower.exe 2548 spower.exe 2548 spower.exe 2548 spower.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe 4996 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2548 spower.exe Token: SeDebugPrivilege 4996 svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4784 wrote to memory of 2548 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 90 PID 4784 wrote to memory of 2548 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 90 PID 2548 wrote to memory of 792 2548 spower.exe 10 PID 2548 wrote to memory of 792 2548 spower.exe 10 PID 2548 wrote to memory of 792 2548 spower.exe 10 PID 4784 wrote to memory of 4996 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 93 PID 4784 wrote to memory of 4996 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 93 PID 4784 wrote to memory of 4996 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 93 PID 4784 wrote to memory of 2248 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 94 PID 4784 wrote to memory of 2248 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 94 PID 4784 wrote to memory of 2248 4784 4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe 94
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe"C:\Users\Admin\AppData\Local\Temp\4e10ba8614241b2f8de229ce8219e24a9c0d34e28ac7419e40c533f8807bc4da.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\lbd95tprvtoesbp\spower.exeC:\Users\Admin\AppData\Local\Temp\lbd95tprvtoesbp\spower.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
-
-
C:\ProgramData\NVIDIARV\svchost.exeC:\ProgramData\NVIDIARV\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Pictureslbd95tpr\CCCef3Render.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5c42379ca208a33e2496ea4f5da6c9f24
SHA1f0dc893080344a1873f84ee7221d5aa08a480e4a
SHA2563106d03a8d2451396f2d799001e87d4f5393d58028f142c763356e20be9fbaf4
SHA51273e5beb73a3ee9ca82cbe740d9ed84c7a03d3f0fb3b707273f7e93c22a09e1a0ac6ff9e353651c906dd608faff09c0c395eda4c7a213a15d164f1024b4580186
-
Filesize
2.7MB
MD5ac30909929056007eaf0fbcf53c3a21f
SHA17046d48c84748b246ebaa1c0153e8f81d3b0acc1
SHA256f11baf3657a9bbfeb5d140a37d456573f589212447446a1519033ad010b9f58f
SHA51271a40652f3cdfbd33cfc539855d6cbb1fba601e83bbd4b3e4f5e397144b3abfed5d148b486aec4eec17136e063609f93beae72a5e78d12d876dd79ccd3c9c849