File name:

c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40

Full analysis: https://app.any.run/tasks/fba69444-af78-40bc-84d2-d77c5a35aad1
Verdict: Malicious activity
Analysis date: January 10, 2025, 19:31:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
blackmoon
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

6B3FC2A1450A29D3B34AA749A9F0884D

SHA1:

4DBA477FB3AAA67158FACFDBC5370E73CE7405C8

SHA256:

C1208D8AF016103D1E61E3453DA5966CDFF7F1550A753F791C6C68643FA9BC40

SSDEEP:

24576:T8BPwuSzAokvw/bcam5y1v5TsJCawRr568LAdcVhuXXMPfeP:T8BPwuSzAokvw/bcam5y1v5QJCawR161

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMOON has been detected (YARA)

      • c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe (PID: 4824)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe (PID: 4824)

    • There is functionality for taking screenshot (YARA)

      • c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe (PID: 4824)

  • INFO

    • Checks supported languages

      • c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe (PID: 4824)

    • The sample compiled with chinese language support

      • c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe (PID: 4824)

    • Reads the computer name

      • c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe (PID: 4824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

Comments: 本程序使用易语言编写(http://www.eyuyan.com)
LegalCopyright: 作者版权所有 请尊重并使用正版
ProductVersion: 1.0.0.0
ProductName: 易语言程序
FileDescription: 易语言程序
FileVersion: 1.0.0.0
CharacterSet: Unicode
LanguageCode: Chinese (Simplified)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x2e28d0
UninitializedDataSize: 2347008
InitializedDataSize: 4096
CodeSize: 679936
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2025:01:10 14:37:15+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
120
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #BLACKMOON c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe

Process information

PID
CMD
Path
Indicators
Parent process
4824"C:\Users\admin\Desktop\c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe" C:\Users\admin\Desktop\c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
易语言程序
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
166
Read events
166
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.113:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2736
svchost.exe
GET
200
2.16.164.113:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2380
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2380
RUXIMICS.exe
GET
200
2.16.164.113:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2736
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2380
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2736
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.113:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2380
RUXIMICS.exe
2.16.164.113:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2736
svchost.exe
2.16.164.113:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2380
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2736
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 2.16.164.113
  • 2.16.164.112
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
self.events.data.microsoft.com
  • 20.189.173.25
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
c1208d8af016103d1e61e3453da5966cdff7f1550a753f791c6c68643fa9bc40