Analysis
-
max time kernel
139s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 10:14
Behavioral task
behavioral1
Sample
ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe
Resource
win7-20240903-en
General
-
Target
ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe
-
Size
135KB
-
MD5
df8b866a627276896b882e843caedbfa
-
SHA1
19e752365adeb77e37e5288b8a95a92f41d6ded2
-
SHA256
ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5
-
SHA512
a8a831d6082a6194721c88ed81e4d39458a035ee39366d5a79438a3e2eb3662919c7d20cb82195479d0cab259ae65214ac60805fc6d11e767f45b532d46db9e1
-
SSDEEP
3072:1lRG2oPJF4uJgJqcM8420jeAA3IY3atZWN0:1lEWuOJqc22y4B3H
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral1/memory/2612-16-0x0000000000400000-0x0000000000635000-memory.dmp family_blackmoon behavioral1/memory/2612-35-0x0000000000400000-0x0000000000635000-memory.dmp family_blackmoon behavioral1/memory/2612-50-0x0000000000400000-0x0000000000635000-memory.dmp family_blackmoon -
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatalrat family
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral1/memory/2800-45-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 2832 spower.exe 2800 svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe -
resource yara_rule behavioral1/files/0x0005000000019b0d-20.dat vmprotect behavioral1/memory/2832-30-0x000000013F930000-0x000000013FEDC000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHTASKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2560 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 2832 spower.exe 2832 spower.exe 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2832 spower.exe Token: SeDebugPrivilege 2800 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2832 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 32 PID 2612 wrote to memory of 2832 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 32 PID 2612 wrote to memory of 2832 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 32 PID 2612 wrote to memory of 2832 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 32 PID 2832 wrote to memory of 604 2832 spower.exe 9 PID 2612 wrote to memory of 2800 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 33 PID 2612 wrote to memory of 2800 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 33 PID 2612 wrote to memory of 2800 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 33 PID 2612 wrote to memory of 2800 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 33 PID 2612 wrote to memory of 2560 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 34 PID 2612 wrote to memory of 2560 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 34 PID 2612 wrote to memory of 2560 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 34 PID 2612 wrote to memory of 2560 2612 ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe 34
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe"C:\Users\Admin\AppData\Local\Temp\ea6b15a15ed32d3965b45552a7e87fd5bdb0a4e21d26063f47102c0fb209e3d5.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\6og7zt1tpnz7fzf\spower.exeC:\Users\Admin\AppData\Local\Temp\6og7zt1tpnz7fzf\spower.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
-
-
C:\ProgramData\NVIDIARV\svchost.exeC:\ProgramData\NVIDIARV\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Pictures6og7zt1t\CCCef3Render.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5c42379ca208a33e2496ea4f5da6c9f24
SHA1f0dc893080344a1873f84ee7221d5aa08a480e4a
SHA2563106d03a8d2451396f2d799001e87d4f5393d58028f142c763356e20be9fbaf4
SHA51273e5beb73a3ee9ca82cbe740d9ed84c7a03d3f0fb3b707273f7e93c22a09e1a0ac6ff9e353651c906dd608faff09c0c395eda4c7a213a15d164f1024b4580186
-
Filesize
2.7MB
MD5ac30909929056007eaf0fbcf53c3a21f
SHA17046d48c84748b246ebaa1c0153e8f81d3b0acc1
SHA256f11baf3657a9bbfeb5d140a37d456573f589212447446a1519033ad010b9f58f
SHA51271a40652f3cdfbd33cfc539855d6cbb1fba601e83bbd4b3e4f5e397144b3abfed5d148b486aec4eec17136e063609f93beae72a5e78d12d876dd79ccd3c9c849