Analysis
-
max time kernel
119s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe
Resource
win10v2004-20241007-en
General
-
Target
f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe
-
Size
2.0MB
-
MD5
ebd4bf9d027377c302d811589f88fca0
-
SHA1
73cb7b4678b0386f696c6bc21e87495aba46b433
-
SHA256
f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96
-
SHA512
4ea20a9302c887f55795ac237a698bfe53036de8543d1c1043057201677d0c88a55ad6458402caad96056793f1fcafc464fce4c5e00fc34b7205f4ba642d56a0
-
SSDEEP
49152:fmTWr53HxurntpSJU2mN2xl42d91cKSd5W6l/p7AFWVBpG947fVr0YfwCCkB1mpt:fmTWr53HxurntpSJU2mN2xu2d91cKSdo
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 10 IoCs
resource yara_rule behavioral2/memory/1696-36-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/1696-51-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/1696-52-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/1696-56-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/1696-59-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/1696-61-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/1696-63-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/1696-66-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/1696-68-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/1696-73-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IDungProV5.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IDungProV5.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe -
Executes dropped EXE 3 IoCs
pid Process 4512 WindowsDef.exe 1696 WindowsDef.exe 1700 WindowsDef.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4512 set thread context of 1696 4512 WindowsDef.exe 89 PID 4512 set thread context of 1700 4512 WindowsDef.exe 90 -
resource yara_rule behavioral2/memory/1696-31-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1696-34-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1696-36-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1700-44-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1700-40-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1700-46-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1696-51-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1696-52-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1700-53-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1696-56-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1696-59-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1696-61-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1696-63-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1696-66-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1696-68-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1696-73-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsDef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsDef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsDef.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4636 reg.exe 2016 reg.exe 2548 reg.exe 4492 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 1696 WindowsDef.exe Token: SeCreateTokenPrivilege 1696 WindowsDef.exe Token: SeAssignPrimaryTokenPrivilege 1696 WindowsDef.exe Token: SeLockMemoryPrivilege 1696 WindowsDef.exe Token: SeIncreaseQuotaPrivilege 1696 WindowsDef.exe Token: SeMachineAccountPrivilege 1696 WindowsDef.exe Token: SeTcbPrivilege 1696 WindowsDef.exe Token: SeSecurityPrivilege 1696 WindowsDef.exe Token: SeTakeOwnershipPrivilege 1696 WindowsDef.exe Token: SeLoadDriverPrivilege 1696 WindowsDef.exe Token: SeSystemProfilePrivilege 1696 WindowsDef.exe Token: SeSystemtimePrivilege 1696 WindowsDef.exe Token: SeProfSingleProcessPrivilege 1696 WindowsDef.exe Token: SeIncBasePriorityPrivilege 1696 WindowsDef.exe Token: SeCreatePagefilePrivilege 1696 WindowsDef.exe Token: SeCreatePermanentPrivilege 1696 WindowsDef.exe Token: SeBackupPrivilege 1696 WindowsDef.exe Token: SeRestorePrivilege 1696 WindowsDef.exe Token: SeShutdownPrivilege 1696 WindowsDef.exe Token: SeDebugPrivilege 1696 WindowsDef.exe Token: SeAuditPrivilege 1696 WindowsDef.exe Token: SeSystemEnvironmentPrivilege 1696 WindowsDef.exe Token: SeChangeNotifyPrivilege 1696 WindowsDef.exe Token: SeRemoteShutdownPrivilege 1696 WindowsDef.exe Token: SeUndockPrivilege 1696 WindowsDef.exe Token: SeSyncAgentPrivilege 1696 WindowsDef.exe Token: SeEnableDelegationPrivilege 1696 WindowsDef.exe Token: SeManageVolumePrivilege 1696 WindowsDef.exe Token: SeImpersonatePrivilege 1696 WindowsDef.exe Token: SeCreateGlobalPrivilege 1696 WindowsDef.exe Token: 31 1696 WindowsDef.exe Token: 32 1696 WindowsDef.exe Token: 33 1696 WindowsDef.exe Token: 34 1696 WindowsDef.exe Token: 35 1696 WindowsDef.exe Token: SeDebugPrivilege 1700 WindowsDef.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3316 f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe 4512 WindowsDef.exe 1696 WindowsDef.exe 1696 WindowsDef.exe 1700 WindowsDef.exe 1696 WindowsDef.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 3316 wrote to memory of 3376 3316 f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe 84 PID 3316 wrote to memory of 3376 3316 f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe 84 PID 3316 wrote to memory of 3376 3316 f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe 84 PID 3376 wrote to memory of 2688 3376 cmd.exe 87 PID 3376 wrote to memory of 2688 3376 cmd.exe 87 PID 3376 wrote to memory of 2688 3376 cmd.exe 87 PID 3316 wrote to memory of 4512 3316 f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe 88 PID 3316 wrote to memory of 4512 3316 f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe 88 PID 3316 wrote to memory of 4512 3316 f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe 88 PID 4512 wrote to memory of 1696 4512 WindowsDef.exe 89 PID 4512 wrote to memory of 1696 4512 WindowsDef.exe 89 PID 4512 wrote to memory of 1696 4512 WindowsDef.exe 89 PID 4512 wrote to memory of 1696 4512 WindowsDef.exe 89 PID 4512 wrote to memory of 1696 4512 WindowsDef.exe 89 PID 4512 wrote to memory of 1696 4512 WindowsDef.exe 89 PID 4512 wrote to memory of 1696 4512 WindowsDef.exe 89 PID 4512 wrote to memory of 1696 4512 WindowsDef.exe 89 PID 4512 wrote to memory of 1700 4512 WindowsDef.exe 90 PID 4512 wrote to memory of 1700 4512 WindowsDef.exe 90 PID 4512 wrote to memory of 1700 4512 WindowsDef.exe 90 PID 4512 wrote to memory of 1700 4512 WindowsDef.exe 90 PID 4512 wrote to memory of 1700 4512 WindowsDef.exe 90 PID 4512 wrote to memory of 1700 4512 WindowsDef.exe 90 PID 4512 wrote to memory of 1700 4512 WindowsDef.exe 90 PID 4512 wrote to memory of 1700 4512 WindowsDef.exe 90 PID 1696 wrote to memory of 428 1696 WindowsDef.exe 91 PID 1696 wrote to memory of 428 1696 WindowsDef.exe 91 PID 1696 wrote to memory of 428 1696 WindowsDef.exe 91 PID 1696 wrote to memory of 2264 1696 WindowsDef.exe 92 PID 1696 wrote to memory of 2264 1696 WindowsDef.exe 92 PID 1696 wrote to memory of 2264 1696 WindowsDef.exe 92 PID 1696 wrote to memory of 2260 1696 WindowsDef.exe 93 PID 1696 wrote to memory of 2260 1696 WindowsDef.exe 93 PID 1696 wrote to memory of 2260 1696 WindowsDef.exe 93 PID 1696 wrote to memory of 3456 1696 WindowsDef.exe 94 PID 1696 wrote to memory of 3456 1696 WindowsDef.exe 94 PID 1696 wrote to memory of 3456 1696 WindowsDef.exe 94 PID 428 wrote to memory of 4636 428 cmd.exe 99 PID 428 wrote to memory of 4636 428 cmd.exe 99 PID 428 wrote to memory of 4636 428 cmd.exe 99 PID 2264 wrote to memory of 2548 2264 cmd.exe 100 PID 2264 wrote to memory of 2548 2264 cmd.exe 100 PID 2264 wrote to memory of 2548 2264 cmd.exe 100 PID 3456 wrote to memory of 2016 3456 cmd.exe 101 PID 3456 wrote to memory of 2016 3456 cmd.exe 101 PID 3456 wrote to memory of 2016 3456 cmd.exe 101 PID 2260 wrote to memory of 4492 2260 cmd.exe 102 PID 2260 wrote to memory of 4492 2260 cmd.exe 102 PID 2260 wrote to memory of 4492 2260 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe"C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZTSnl.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2688
-
-
-
C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe"C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exeC:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4636
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2548
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4492
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2016
-
-
-
-
C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exeC:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1700
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD512506b1a3ef0e7dcef2babaaecfb81e8
SHA19564f2c31b336dab739e74cceedb5e4d07c2a563
SHA2563922b88903f6e7a4cd1e9cee92f9a0de6f0cd28a4a6db73114e320fa7cbf8c8a
SHA512cbf0ade56c9961edcf8018f8e1654446e17c863e8df98a78b781b4b91ca87a9ab3b1532376f245c678f6f9e00771d74dba99e0fee237ebf3f4a69473d57f0dec
-
Filesize
2.0MB
MD5961ad0927901c72bfab5b7be378df88f
SHA1a7291238e8c4b39c4cbcfb2c7240f3201be4f0c1
SHA256966c936b44a9e7cd43c7eaa18be65b4cf813ef63caaeb8f412d894349e257bf0
SHA512175e30df354c6bbdf5fa330aed40ee5cd8d49a48bcd8f3f80e0f6aad4436547dd9fb3b15f494989ee0149d6c805a5e1db5408b2fcc7774aa457fd266e437b8f9