blackcat | 2f5033aca6fd4e5b9382f73160d7f6c5091f13f0008e97502eb0260dde2d4eaf

Analysis

max time kernel
142s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2024, 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sch1.exe
Size

12.6MB
MD5

a0cd8aa1cd7cc61d41977cceacd7d4f6
SHA1

83078ff956e5e441429257cfa3a3362d6ba3c0d5
SHA256

df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c
SHA512

2f147b25d3289f33623dd3fdfd339de75b71cab4eb6348d0a176815bc1a7a86889113c40b6b1d3a2eb275fd76c16dbbe0eb38e63584ce2f5005a13c7369e68db
SSDEEP

196608:zRXBBaGSqkZRLVupoP3/ih4a4kZLm77gZ9rwaATAZjiEjOvonfT:p/+j/ih4a4k9M5kjiOOvonfT

Score

10^/10

blackcat discovery ransomware

Malware Config

Signatures

BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
ransomware blackcat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sch1.exe

C:\Users\Admin\AppData\Local\Temp\sch1.exe
"C:\Users\Admin\AppData\Local\Temp\sch1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-0-0x0000000000270000-0x0000000000F10000-memory.dmp

Filesize
12.6MB

Download