File name:

9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b

Full analysis: https://app.any.run/tasks/3bba4402-533c-4088-944b-75ead49ef666
Verdict: Malicious activity
Analysis date: December 13, 2024, 22:13:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
upx
aspack
blackmoon
ip-check
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

28E2B09D0A1797053FF85EC31FC5CF44

SHA1:

D93BF01E7F41E62851E9EA44B5B1B252D1CDE428

SHA256:

9841BB3A9A66C3EF3EEBE760FA4E9175C3C2088BC8D510A5603DED9F81631D0B

SSDEEP:

98304:vdNfopqI27alB+Ltl3FUTG9yo9AnxOY7V53V3fezDR19ZwSZSP5AByHANZnd58Ms:ruDp9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMOON has been detected (YARA)

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

  • SUSPICIOUS

    • There is functionality for capture public ip (YARA)

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

    • There is functionality for taking screenshot (YARA)

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

    • Checks for external IP

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

  • INFO

    • Checks supported languages

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

    • Reads the machine GUID from the registry

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

    • Reads the software policy settings

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

    • Create files in a temporary directory

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

    • Reads the computer name

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

    • UPX packer has been detected

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)

    • Aspack has been detected

      • 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe (PID: 1580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (24.4)
.exe | Win64 Executable (generic) (21.6)
.exe | UPX compressed Win32 Executable (21.2)
.exe | Win32 EXE Yoda's Crypter (20.8)
.dll | Win32 Dynamic Link Library (generic) (5.1)

EXIF

EXE

Comments: 本程序使用易语言编写(http://www.dywt.com.cn)
LegalCopyright: 作者版权所有 请尊重并使用正版
ProductVersion: 1.0.0.0
ProductName: 易语言程序
FileDescription: 易语言程序
FileVersion: 1.0.0.0
CharacterSet: Unicode
LanguageCode: Chinese (Simplified)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0xeee9c
UninitializedDataSize: -
InitializedDataSize: 1970176
CodeSize: 1118208
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2024:12:12 05:38:44+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
119
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe no specs #BLACKMOON 9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe

Process information

PID
CMD
Path
Indicators
Parent process
2216"C:\Users\admin\Desktop\9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe" C:\Users\admin\Desktop\9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
易语言程序
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1580"C:\Users\admin\Desktop\9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe" C:\Users\admin\Desktop\9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
易语言程序
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
Total events
3 253
Read events
3 253
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
15809841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exeC:\Users\admin\AppData\Local\Temp\MY.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\Lock.locktext
MD5:C1EF95B5E310736A156C55145251FE5D
SHA256:653A1BA7323B59ECC93D83EB39688919F3EAD432152AFDD5811A8748F9402ABD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
8
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1580
9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe
GET
—
59.57.13.182:80
http://2017.ip138.com/ic.asp
unknown
—
—
—
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1580
9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe
GET
301
123.129.219.142:80
http://ip.chinaz.com/getip.aspx
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
404
123.129.219.142:443
https://ip.chinaz.com/getip.aspx
unknown
html
28.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
1468
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1580
9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe
123.129.219.142:80
ip.chinaz.com
CHINA UNICOM China169 Backbone
CN
whitelisted
1580
9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b.exe
123.129.219.142:443
ip.chinaz.com
CHINA UNICOM China169 Backbone
CN
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1468
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.46
whitelisted
ip.chinaz.com
  • 123.129.219.142
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
2017.ip138.com
  • 59.57.13.182
  • 59.57.13.133
  • 59.57.14.11
  • 110.81.155.137
  • 110.81.155.138
unknown
self.events.data.microsoft.com
  • 20.189.173.28
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9841bb3a9a66c3ef3eebe760fa4e9175c3c2088bc8d510a5603ded9f81631d0b