Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 14:41
Behavioral task
behavioral1
Sample
cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe
Resource
win10v2004-20241007-en
General
-
Target
cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe
-
Size
3.0MB
-
MD5
7af7dcaa4cf585c950226a2cf311ecff
-
SHA1
30aa8308c3ff8429216dd4fb49993d7020251376
-
SHA256
cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740
-
SHA512
a662549c8642c24bc938fe470b4a7ed92bd25af8798cfbc1c2faf1669766a1531f3f97dbea964a8d0f1140bf58f419d6e384c0eb65bcfa37b018c38cbb6c8f9c
-
SSDEEP
98304:AOL9eBmpJ6HDT2MtUmmJqvOwcdI/X48ETeO7:lRpJ6HDT2MtUmmJqvOwcdI/X48ETeO7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral2/memory/4392-13-0x0000000010000000-0x0000000010025000-memory.dmp family_blackmoon -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bQiDBCFdPZ\ImagePath = "\\??\\C:\\Gsc31EiF.sys" cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ivdkhq\ImagePath = "\\??\\C:\\Windows\\Fonts\\ivdkhq.sys" cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\ivdkhq.sys cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe File opened for modification C:\Windows\Fonts\ivdkhq.sys cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1984 sc.exe 924 sc.exe 3948 sc.exe 3772 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Kills process with taskkill 1 IoCs
pid Process 1692 taskkill.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe Token: SeDebugPrivilege 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe Token: SeDebugPrivilege 1692 taskkill.exe Token: SeCreateGlobalPrivilege 2448 dwm.exe Token: SeChangeNotifyPrivilege 2448 dwm.exe Token: 33 2448 dwm.exe Token: SeIncBasePriorityPrivilege 2448 dwm.exe Token: SeDebugPrivilege 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe Token: SeShutdownPrivilege 2448 dwm.exe Token: SeCreatePagefilePrivilege 2448 dwm.exe Token: SeShutdownPrivilege 2448 dwm.exe Token: SeCreatePagefilePrivilege 2448 dwm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4392 wrote to memory of 3412 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 84 PID 4392 wrote to memory of 3412 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 84 PID 4392 wrote to memory of 1692 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 85 PID 4392 wrote to memory of 1692 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 85 PID 4392 wrote to memory of 1692 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 85 PID 4392 wrote to memory of 4352 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 90 PID 4392 wrote to memory of 4352 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 90 PID 4392 wrote to memory of 4352 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 90 PID 4352 wrote to memory of 1984 4352 CMD.exe 92 PID 4352 wrote to memory of 1984 4352 CMD.exe 92 PID 4352 wrote to memory of 1984 4352 CMD.exe 92 PID 4392 wrote to memory of 468 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 93 PID 4392 wrote to memory of 468 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 93 PID 4392 wrote to memory of 468 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 93 PID 468 wrote to memory of 924 468 CMD.exe 95 PID 468 wrote to memory of 924 468 CMD.exe 95 PID 468 wrote to memory of 924 468 CMD.exe 95 PID 4392 wrote to memory of 4664 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 96 PID 4392 wrote to memory of 4664 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 96 PID 4392 wrote to memory of 4664 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 96 PID 4664 wrote to memory of 3948 4664 CMD.exe 98 PID 4664 wrote to memory of 3948 4664 CMD.exe 98 PID 4664 wrote to memory of 3948 4664 CMD.exe 98 PID 4392 wrote to memory of 4276 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 99 PID 4392 wrote to memory of 4276 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 99 PID 4392 wrote to memory of 4276 4392 cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe 99 PID 4276 wrote to memory of 3772 4276 CMD.exe 101 PID 4276 wrote to memory of 3772 4276 CMD.exe 101 PID 4276 wrote to memory of 3772 4276 CMD.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe"C:\Users\Admin\AppData\Local\Temp\cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe"1⤵
- Sets service image path in registry
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3412
-
-
C:\Windows\SysWOW64\taskkill.exeC:\Windows\System32\taskkill /f /pid 3802⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C SC STOP ivdkhq2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\sc.exeSC STOP ivdkhq3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1984
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C SC DELETE ivdkhq2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\sc.exeSC DELETE ivdkhq3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:924
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C SC STOP ivdkhq2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\sc.exeSC STOP ivdkhq3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3948
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C SC DELETE ivdkhq2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\sc.exeSC DELETE ivdkhq3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3772
-
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2448
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cfbae59932428699b28f24636ef31548bc5c0a6542550c0c287ff9e87748a740.exe
Filesize3.0MB
MD5c119e6f3ec97fb8fd246e1784af0d826
SHA18678d2846df714dc89628b784fd25355628c350f
SHA256bc3b16825c47824b41591a1897ff2e7542cbdabde6c62d330405784f80930cdd
SHA51235ea350c84967f9548757c45ef3a4c22c352a506b9a047fb3c5e01c1ff773f59e0c6e632843cf6e4925acf38e39a9b6d9d987031d622dfb8f3e827fbac205625