Analysis
- max time kernel
299s - max time network
284s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system - submitted
18/03/2025, 02:22
Behavioral task
behavioral1
Sample
32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe
Resource
win7-20241023-en
windows7-x64
12 signatures
300 seconds
General
- Target 32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe
- Size 339KB
- Sample250318-ctr1jswlx2
- SHA256 32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de
- MD5 29925e49ebee7466d78ba6896de1b280
- SHA1 3b8da560f2436a3a065fadfdb542c753f40bdcd9
- SHA512 c771c9e91fd150249c76974ba55d9e1f1b00e8c734d27efc093ad68b613ed133c728caec0133df303f82270b563064929d206c147d41e2d95702a0cde0c683ec
- SSDEEP 6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsx1:IXdaAqvRwWoe2XjSVvUYuyHWPBsx1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral2/files/0x00070000000240f8-27.dat family_blackmoon - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation 32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe - Executes dropped EXE 1 IoCs
pid Process 2416 Sysceamyclac.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysceamyclac.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe 2416 Sysceamyclac.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1352 wrote to memory of 2416 1352 32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe 89 PID 1352 wrote to memory of 2416 1352 32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe 89 PID 1352 wrote to memory of 2416 1352 32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe"C:\Users\Admin\AppData\Local\Temp\32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\Sysceamyclac.exe"C:\Users\Admin\AppData\Local\Temp\Sysceamyclac.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C
- Size 471B
- SHA256 199b44a2d5a612c2eb543d4d781201fd3127af4418e308866e0803d9ba24262e
- MD5 748ac2950512e7a84706ead4ae3ca696
- SHA1 721e46335a8612ef899a10a398f09832710914b6
- SHA512 79e3167a99a4f30935825c8cc06ce4782012cb551db16826df40ff7c1506b88b0133cdd3195755568dc78b19c345fc000ce27b240f68f641c9338abba2b9801f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F263F63198568CED7739E17893D8775_CF1B4004AECEBF2DA58DF22FDCAD263F
- Size 471B
- SHA256 f1169cccbdce28cdf2cc7cec47e75a3f4fd9addfdcefb963e2ffdca75af5f69e
- MD5 953ae899d5687a9cb61c8b825601a03d
- SHA1 40fec0f63286feb4b7ab9feb88607024591b06ed
- SHA512 d5b0161b9413cf9e98deb3a5bbfaab207efb31990692f4dcf3374bd1d17393cd4a2d761dc3dbaadedd689f0a23910ff431712ebe9533943a5f746649a2b70e05
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A406A0C16078CBE0C5819DA376FB1D88_62573A0254D54D5CD82EB4B17EEF9776
- Size 727B
- SHA256 860972cfe22375342d4db21a4a684f9e528e96dec6f96a313092c27e361dfd65
- MD5 3ac89ccb8fec499cfe37b87a91390e3e
- SHA1 9bffbb44a7698a15e3344e7105b09a965ce66aed
- SHA512 12be431a1c3323b52a940bbf9b70dd9ffdab39bc0b31596dbe68aac59dad9107ada75c851f9e86c64e25e9ac88bfed72a3c76d6f57ca4ce6ebe39150e6c5455c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_A0B760D8ABF6F649D185B46E3E114CC2
- Size 471B
- SHA256 b1a4186d325a70198b7662eb18094bf097fc349ed2f3c9f9226f518c4d0b4acb
- MD5 dee3b52e37da8d91dbd87b552263ce4a
- SHA1 7b92d79052d127852947eb6d45a5744c74d465b4
- SHA512 420b058aaafedad2de52cc011c5554197aed6e1c911b20eb7a822badad06f606ee1e21071ffba41b1100c4516cec920330320fd45816d2cba1d7a6fda6a51eba
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C
- Size 398B
- SHA256 b2cfedba25a2bf4b12aa673e18c682f08b6daa8dbb119e0feb05d8fa40891ed2
- MD5 10e98984d592543ace3ffe0174c32ddf
- SHA1 59dd40a80cd2d5e9a7f8b826d7d5391a3aef11db
- SHA512 b6c509b9221f7507c9ac35c2b71472b0e47c036ad1807974d8a6bc9316ac947d3841fea694057b16a92bdf30ab2127ef98c90b51851dd4f1281730aa191821dc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F263F63198568CED7739E17893D8775_CF1B4004AECEBF2DA58DF22FDCAD263F
- Size 414B
- SHA256 adbf75e1c59965dcd4d837698911f272d40f0bbd8c51c6f7505969cae512b481
- MD5 bfd91216eb4516b4377235efe21db145
- SHA1 ddcf078da0e788a0ea84bfd169b9d1299b3ad32b
- SHA512 2bb974b525a21dbbd698bd16479b359d6350877e25a9a1c424634399e98d56636b2a64bc2b207ae87dcf053fdb610dc880c4101f1bba8664f9e8dc17ef0212c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A406A0C16078CBE0C5819DA376FB1D88_62573A0254D54D5CD82EB4B17EEF9776
- Size 406B
- SHA256 7805d15c53088a839efa9ee05ccd1a5d045ba29fb856ad3681c15a8e281d2120
- MD5 f204ccfa7c1c6a0a9be7bd42e662410d
- SHA1 806b7ede3b379e5a7a1880cf6c5bc6b4bbe5028e
- SHA512 3b91bd1afc389b284d7feeafdec25a5e53176ab4b0ef45208cedc4a61907b7ff0fd5805ca6a5d7584240760c996fa4d871db301cba2a9a1f80075aff8f892890
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_A0B760D8ABF6F649D185B46E3E114CC2
- Size 410B
- SHA256 75f26cdf78bd9e629b5dc079e1f22cc23e407500ee967b83ec4876d412e85957
- MD5 d2c9fb6197b54bceff0164320027aad6
- SHA1 ba60f60187e80921727f982fa60ccd125439917b
- SHA512 3edddc03be94ac852496cfa26695faaf8afd370fa60f52bc607dd0b23b93d640bf0f2524510a357eadea4ae827d913c2c3086d90c079d717894494caae32e3ff
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Sysceamyclac.exe
- Size 339KB
- SHA256 6fe7620a7a617ae4dec37ea007f0d3b8b3d79a778def41d1419bb750b9da59b6
- MD5 7c6362aaaa42f0ea5d3ca48515605092
- SHA1 d44c8a078e85908748eb55ba877936417dfb36f7
- SHA512 05403f27c0ee7a588c012dd2c21f5d388c0e492b2491462ef66c60599c0198daf599a008fba5c179d77630928da9f44e5cdfb86eaef5da8f3d6cedd282f6d859
- SSDEEP 6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsxW:IXdaAqvRwWoe2XjSVvUYuyHWPBsxW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cpath.ini
- Size 102B
- SHA256 43df73d8cb456ea8ed9c236a58b5587a6c59877c9e026fcd6b31925436c28013
- MD5 664c199d6569a35101a3245ed3de9eea
- SHA1 49c4e25a77b83cacd69dfd59ff7ba2f86b4dfd34
- SHA512 cb2567ac507d941792f3d214f043a321beec068d54b075e6746ce86ff163119766c677c486b521a5b1023ef57218bdbc664145a541c1a9bc68a6d9431b28bb77
- MD5 SHA1 SHA512