File name:

acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82

Full analysis: https://app.any.run/tasks/addba803-98fb-4d69-821e-15c33a9066c0
Verdict: Malicious activity
Analysis date: January 10, 2025, 18:28:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
blackmoon
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

F44545848CA9B1261DE96CA55047A58A

SHA1:

02D3B8149E3DBC6E9DD5410E9B2D4247A6C42377

SHA256:

ACDE91920549C78F413EA3FA20B2206AEEF21C8A697085E7BEAB62911DD0FE82

SSDEEP:

24576:DcO83uGeB+AtNPtRelC9L1wat76ZZzHxf0HVAGV6zKP/txJGxCAba395TL7btG:Dc13uGeB+AtNPtRelC9L1wat76ZZzRfF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • BLACKMOON has been detected (YARA)

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
  • SUSPICIOUS

    • Creates file in the systems drive root

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
  • INFO

    • The sample compiled with chinese language support

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
    • Reads the computer name

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
    • Checks supported languages

      • acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe (PID: 6472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

Comments: 本程序使用易语言编写(http://www.eyuyan.com)
LegalCopyright: 作者版权所有 请尊重并使用正版
ProductVersion: 1.0.0.0
ProductName: 易语言程序
FileDescription: 易语言程序
FileVersion: 1.0.0.0
CharacterSet: Unicode
LanguageCode: Chinese (Simplified)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x2f0ea0
UninitializedDataSize: 2371584
InitializedDataSize: 4096
CodeSize: 712704
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2025:01:10 14:40:17+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
116
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #BLACKMOON acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe

Process information

PID
CMD
Path
Indicators
Parent process
6472"C:\Users\admin\Desktop\acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe" C:\Users\admin\Desktop\acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
易语言程序
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\acde91920549c78f413ea3fa20b2206aeef21c8a697085e7beab62911dd0fe82.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
166
Read events
166
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
32
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1016
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
unknown
4
System
192.168.100.255:138
unknown
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1016
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
unknown
1016
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
unknown
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1016
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
unknown
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 4.231.128.59
  • 40.127.240.158
unknown
google.com
  • 142.250.186.142
unknown
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
unknown
www.microsoft.com
  • 2.23.246.101
unknown
self.events.data.microsoft.com
  • 13.69.116.107
unknown

Threats

No threats detected
No debug info