Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-01-2025 15:44
Behavioral task
behavioral1
Sample
486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe
Resource
win10v2004-20241007-en
General
-
Target
486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe
-
Size
2.8MB
-
MD5
85cae604e479331c6fc1ad6f91f8baab
-
SHA1
fca25f2e74001c4c632efbcf7cd9816530b53fa1
-
SHA256
486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93
-
SHA512
32bd4ca5a23ba455257d94d5164516d879e55e495e0a54341a4b44147b02869e482b6e83ab5f5e85798a85e741eaac21818cb42517a2f092c36683618f9c1a9a
-
SSDEEP
24576:4l18GADX15DihL9GVRqIERogW68ngSTeTm8HZfj4cCao6A6u2EmAOuydnTX2tuiD:4O7SL9eq67ydBC/S2mpTnf1cF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral1/memory/2244-10-0x0000000010000000-0x0000000010025000-memory.dmp family_blackmoon -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\roosbk\ImagePath = "\\??\\C:\\Windows\\Fonts\\roosbk.sys" 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\roosbk.sys 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe File opened for modification C:\Windows\Fonts\roosbk.sys 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1528 sc.exe 272 sc.exe 1112 sc.exe 2388 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 476 Process not Found 476 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe Token: SeDebugPrivilege 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe Token: SeDebugPrivilege 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2776 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 30 PID 2244 wrote to memory of 2776 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 30 PID 2244 wrote to memory of 2776 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 30 PID 2244 wrote to memory of 2776 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 30 PID 2244 wrote to memory of 1628 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 31 PID 2244 wrote to memory of 1628 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 31 PID 2244 wrote to memory of 1628 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 31 PID 2244 wrote to memory of 1628 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 31 PID 1628 wrote to memory of 1528 1628 CMD.exe 33 PID 1628 wrote to memory of 1528 1628 CMD.exe 33 PID 1628 wrote to memory of 1528 1628 CMD.exe 33 PID 1628 wrote to memory of 1528 1628 CMD.exe 33 PID 2244 wrote to memory of 2748 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 34 PID 2244 wrote to memory of 2748 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 34 PID 2244 wrote to memory of 2748 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 34 PID 2244 wrote to memory of 2748 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 34 PID 2748 wrote to memory of 272 2748 CMD.exe 36 PID 2748 wrote to memory of 272 2748 CMD.exe 36 PID 2748 wrote to memory of 272 2748 CMD.exe 36 PID 2748 wrote to memory of 272 2748 CMD.exe 36 PID 2244 wrote to memory of 2524 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 37 PID 2244 wrote to memory of 2524 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 37 PID 2244 wrote to memory of 2524 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 37 PID 2244 wrote to memory of 2524 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 37 PID 2524 wrote to memory of 1112 2524 CMD.exe 39 PID 2524 wrote to memory of 1112 2524 CMD.exe 39 PID 2524 wrote to memory of 1112 2524 CMD.exe 39 PID 2524 wrote to memory of 1112 2524 CMD.exe 39 PID 2244 wrote to memory of 2020 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 40 PID 2244 wrote to memory of 2020 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 40 PID 2244 wrote to memory of 2020 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 40 PID 2244 wrote to memory of 2020 2244 486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe 40 PID 2020 wrote to memory of 2388 2020 CMD.exe 42 PID 2020 wrote to memory of 2388 2020 CMD.exe 42 PID 2020 wrote to memory of 2388 2020 CMD.exe 42 PID 2020 wrote to memory of 2388 2020 CMD.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe"C:\Users\Admin\AppData\Local\Temp\486cb5ab5ca6a6f507128a8ddd25526cd295d1a7cb24d3a66f9d09f497f58f93.exe"1⤵
- Sets service image path in registry
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2776
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C SC STOP roosbk2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\sc.exeSC STOP roosbk3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1528
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C SC DELETE roosbk2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\sc.exeSC DELETE roosbk3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:272
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C SC STOP roosbk2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\sc.exeSC STOP roosbk3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1112
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C SC DELETE roosbk2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\sc.exeSC DELETE roosbk3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2388
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ËÙ¼°°ÌØȸÙÊ°ÖÎô°ÅÈÖµ¼Íͺ³ÒÄÁÕÙ»Æ̳²ËøÔк½ËÕ±ÂÂÚÓǸ´ÉÍÚºÀÒÑ¿·×È\ÄÙ±¿Éж¶ÎÇ»ÖÓ¼ÀÍسÅIJÕÊ»·Ìϲ¼ÃÔÔÁºÙËƱ³ÂËÓº¸ÒÉ¿Ú×ÀÄѱ·ÉȶÙο»ÐÓ¶ÀÇØØž²Ïʵ·ÆÏ×¼½ÔÎÁ²ÙÃÆÔ³ºË˸±Ð½ÓÕ¸ÂÉÚÚÇÀ´ÑÌ·¹ÈÑÙ¾¿ÖÐö°ÇÊØ·¾ÏÏ.lnk
Filesize2.8MB
MD5a878432e3c19e327650f5633ed4b66ae
SHA15412c6ae424bb9cf01560ce74b2be68bf3ac6bda
SHA2565d1210e60be433829fc5ae3e04bf5a7c37b6a8de6559a65221e3937c9e76b11a
SHA5124cd2a45857c1f3e0e008cc327a99f9117bc9f77c999fe2bf1e5b34e63392be518905f9cde80cdbd51f43be9649e230e17308e003642f3129f8a1b73b665a82a8