MALICIOUS — 77d34428c0c7deeef7390b03537b2cc98ac1abc127b3d5126ad31de2f8bbe1e0

MALICIOUS — 77d34428c0c7deeef7390b03537b2cc98ac1abc127b3d5126ad31de2f8bbe1e0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the BlackMoon family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 77d34428c0c7deeef7390b03537b2cc98ac1abc127b3d5126ad31de2f8bbe1e0
SHA-1: 6de873d785f2d8834e7a3900b1f694d4cd7b4ed9
MD5: cc4386eb1704f41ff7817d27133c1710
imphash: 9dacd5fc505421be83fd9ef325d44b59
ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm5+:0cdpeeBSHHMHLf9RyIEQ5KXZV
TLSH: T1F63B1B6796A3A4C9C93470AF3F4E73917400BDF00653798625ACE28FBDA758B46834C6
Submitted as: 77d34428c0c7deeef7390b03537b2cc98ac1abc127b3d5126ad31de2f8bbe1e0
File type: pe · Size: 102188 bytes
Verdict: malicious (98/100) · Family: BlackMoon

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS 2.01-2.12
Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn
Microsoft Defender: Trojan:Win32/Blackmoon!rfn
Emsisoft (Emergency Kit): Adware.GenericKD.61151796
Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 35 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:MPRESS 2.01-2.12 (rule DIE:MPRESS 2.01-2.12) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS 2.01-2.12 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

677 behavior events · 1 ATT&CK techniques · 22 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10170/files/6d5ac8142580ec6d8b42198f988a5078c7c21dec629b94a24ab53e63bf811402 - 6d5ac8142580ec6d8b42198f988a5078c7c21dec629b94a24ab53e63bf811402
/opt/CAPEv2/storage/analyses/10170/files/2fff5a194ede968aa70d96c0c79f3ff36ccd1fd9c5175f484fb35c1bf6d2ac1d - 2fff5a194ede968aa70d96c0c79f3ff36ccd1fd9c5175f484fb35c1bf6d2ac1d
/opt/CAPEv2/storage/analyses/10170/files/5e37a9b0f29c39d0469c1508e665baedc20c1f75952098998a939f53e85dbcc4 - 5e37a9b0f29c39d0469c1508e665baedc20c1f75952098998a939f53e85dbcc4
/opt/CAPEv2/storage/analyses/10170/files/05cdfed3343e68a4c9ab9a1f370fceb6c281507446389c98a2d03380a25531ea - 05cdfed3343e68a4c9ab9a1f370fceb6c281507446389c98a2d03380a25531ea
/opt/CAPEv2/storage/analyses/10170/files/0f6b1c21817598d2cb84d784827fac839e6c2f10344e41561d5780deb732903e - 0f6b1c21817598d2cb84d784827fac839e6c2f10344e41561d5780deb732903e
/opt/CAPEv2/storage/analyses/10170/files/5c32a86511229dea89516cd64c181444cfcc16e7fc5a45b9c690dc8411b58fb2 - 5c32a86511229dea89516cd64c181444cfcc16e7fc5a45b9c690dc8411b58fb2
/opt/CAPEv2/storage/analyses/10170/files/653d41966c64b7bd12991baeb4607b02973771a958808fa4fa748f2c268ca336 - 653d41966c64b7bd12991baeb4607b02973771a958808fa4fa748f2c268ca336
/opt/CAPEv2/storage/analyses/10170/files/530e60fae4b975655b18636dbe0ab61b0a564a644b5bc1143abe4b65f66ddc0e - 530e60fae4b975655b18636dbe0ab61b0a564a644b5bc1143abe4b65f66ddc0e
/opt/CAPEv2/storage/analyses/10170/files/bca68d8f41d5d69c8b16219fdfad85cae014e506d18b24803d505d8bca0dba67 - bca68d8f41d5d69c8b16219fdfad85cae014e506d18b24803d505d8bca0dba67
/opt/CAPEv2/storage/analyses/10170/files/2604bad88a17f25e2273dee409a011e7dd8618f954f247bdd2a5453be61a1061 - 2604bad88a17f25e2273dee409a011e7dd8618f954f247bdd2a5453be61a1061
/opt/CAPEv2/storage/analyses/10170/files/9d9e3582f31ff08794daa1b1f539413713d31ac7997f36ced3d863c616ea93a0 - 9d9e3582f31ff08794daa1b1f539413713d31ac7997f36ced3d863c616ea93a0
/opt/CAPEv2/storage/analyses/10170/files/9b8b55f766ef59af3a82f5baa50bb83df40972f316517b46098db4f09d97777b - 9b8b55f766ef59af3a82f5baa50bb83df40972f316517b46098db4f09d97777b
/opt/CAPEv2/storage/analyses/10170/files/c3b4e5d71e6dd4a42d91e1c41e3754c399b8ad99b117721ed8e9c2b469c908f8 - c3b4e5d71e6dd4a42d91e1c41e3754c399b8ad99b117721ed8e9c2b469c908f8
/opt/CAPEv2/storage/analyses/10170/files/f159ff7de87ce2f37f47b2152afbca5dc8f93a3270a71c51fcaebc2239652897 - f159ff7de87ce2f37f47b2152afbca5dc8f93a3270a71c51fcaebc2239652897
/opt/CAPEv2/storage/analyses/10170/files/587cb7dca3a3625272c8636ce0a7330e456f4d93ca469d18c8c467911325668d - 587cb7dca3a3625272c8636ce0a7330e456f4d93ca469d18c8c467911325668d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786444679&P2=404&P3=2&P4=DQPMOLQCnE4BYIO8mys5t86LrARM37lYFVHdGdbiKMMa%2bT8OeyAatvgo89bdfmkHoXFmcvHy5BYZtHfw12dolQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786444755&P2=404&P3=2&P4=NXAnPA%2fojVwKlgPuBKoip1%2ba%2fEFXdGn7Vv676Z1jmHQoefj%2boN23yfRCorBCvJ6WDuNZ6pbb%2fJcCLVFfqH1Wbw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.73.24
4.230.171.124
57.155.104.224
52.253.84.76
135.232.92.137
74.178.76.54
20.184.175.12
135.233.45.223
52.230.60.54
203.26.79.13
57.154.63.210
52.123.252.212
74.179.71.159
72.145.35.115
52.148.114.188
92.223.78.30
20.42.73.31
52.110.12.51
52.110.12.53

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report