File name:

da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842

Full analysis: https://app.any.run/tasks/14b6159d-8d28-41c3-91a9-281571108277
Verdict: Malicious activity
Analysis date: December 13, 2024, 20:36:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
upx
blackmoon
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

E921739BA6B3C27916C425471890D034

SHA1:

6056E7D83EE2245844A075DDA0AB7A6CDBB2E5C0

SHA256:

DA63B875263A134720680141936A48C2257B3ED3881DE124A6B46F84F9119842

SSDEEP:

98304:F+eHpecHBLEcI00PoAjv+S2ST5FczqcL9yFTxsUtU3cxxVZ3TbicGd2LsmaNYxkf:Dqq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMOON has been detected (YARA)

      • da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe (PID: 6132)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe (PID: 6132)

    • Connects to unusual port

      • da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe (PID: 6132)

    • Checks for external IP

      • da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe (PID: 6132)

  • INFO

    • Reads the computer name

      • da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe (PID: 6132)

    • Checks supported languages

      • da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe (PID: 6132)

    • Reads the machine GUID from the registry

      • da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe (PID: 6132)

    • UPX packer has been detected

      • da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe (PID: 6132)

    • Reads the software policy settings

      • da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe (PID: 6132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (22.1)
.exe | Win64 Executable (generic) (19.6)
.exe | UPX compressed Win32 Executable (19.2)
.exe | Win32 EXE Yoda's Crypter (18.8)
.scr | Windows screen saver (9.3)

EXIF

EXE

Comments: 本程序使用易语言编写(http://www.eyuyan.com)
LegalCopyright: 作者版权所有 请尊重并使用正版
ProductVersion: 1.0.0.0
ProductName: 易语言程序
FileDescription: 易语言程序
FileVersion: 1.0.0.0
CharacterSet: Unicode
LanguageCode: Chinese (Simplified)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0xbccb1
UninitializedDataSize: -
InitializedDataSize: 2027520
CodeSize: 913408
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2024:12:11 01:46:19+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #BLACKMOON da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe

Process information

PID
CMD
Path
Indicators
Parent process
6132"C:\Users\admin\Desktop\da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe" C:\Users\admin\Desktop\da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
易语言程序
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
Total events
3 275
Read events
3 273
Write events
2
Delete events
0

Modification events

(PID) Process:(6132) da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(6132) da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
756A130000000000
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
24
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6068
RUXIMICS.exe
GET
200
184.24.77.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6132
da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe
GET
200
42.120.158.5:80
http://www.net.cn/static/customercare/yourip.asp
unknown
—
—
—
2548
svchost.exe
GET
200
184.24.77.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6132
da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe
GET
200
8.141.58.141:80
http://www.fm4000888.cn/a/zhinenchanpin/2024/0718/38.html
unknown
—
—
—
4712
MoUsoCoreWorker.exe
GET
200
184.24.77.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.9.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6068
RUXIMICS.exe
GET
200
2.23.9.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2548
svchost.exe
GET
200
2.23.9.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
103.235.46.96:443
https://sp0.baidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php?query=24.51.64.180&resource_id=6006
unknown
binary
393 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6068
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2548
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.212.110.144:443
www.bing.com
Akamai International B.V.
CZ
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6132
da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe
8.141.58.141:80
www.fm4000888.cn
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
6132
da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842.exe
8.141.58.141:6699
www.fm4000888.cn
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
4712
MoUsoCoreWorker.exe
184.24.77.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6068
RUXIMICS.exe
184.24.77.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
www.bing.com
  • 23.212.110.144
  • 23.212.110.155
  • 23.212.110.139
  • 23.212.110.146
  • 23.212.110.136
  • 23.212.110.161
  • 23.212.110.145
  • 23.212.110.147
  • 23.212.110.137
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.fm4000888.cn
  • 8.141.58.141
unknown
crl.microsoft.com
  • 184.24.77.19
  • 184.24.77.11
  • 184.24.77.41
  • 184.24.77.27
  • 184.24.77.15
  • 184.24.77.16
  • 184.24.77.10
whitelisted
www.net.cn
  • 42.120.158.5
unknown
www.microsoft.com
  • 2.23.9.218
whitelisted
sp0.baidu.com
  • 103.235.47.188
  • 103.235.46.96
whitelisted
self.events.data.microsoft.com
  • 20.189.173.27
whitelisted

Threats

PID
Process
Class
Message
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup (www .net .cn)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
da63b875263a134720680141936a48c2257b3ed3881de124a6b46f84f9119842