Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe
Resource
win10v2004-20241007-en
General
-
Target
72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe
-
Size
1.8MB
-
MD5
544ee01b78b3c4c3c77cead8b06faee7
-
SHA1
058f7cee673607e34eb438c46d9e5d70af0d8d88
-
SHA256
72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971
-
SHA512
77c90288b39eb199b2a80c308aecb8e4c443903593f3668de26ed29d171850eaf94a82aca95c29cd6dac03364dd5ecefd53c19e23c86c9319e379569d23da754
-
SSDEEP
49152:RNMqQ0kwonLVkZep9nWrPWwONrRoODiGgDWAg2CPaSAnYvJW3BTSXff6YNQVWIP4:RiqQ0kwonLVkZep9nWrPWwONrRoODiGt
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 6 IoCs
resource yara_rule behavioral1/memory/2388-54-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/2388-69-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/2388-71-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/2388-73-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/2388-76-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/2388-78-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Executes dropped EXE 3 IoCs
pid Process 2020 Firefox.exe 2388 Firefox.exe 2872 Firefox.exe -
Loads dropped DLL 7 IoCs
pid Process 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 2020 Firefox.exe 2020 Firefox.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Updater 3 = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2020 set thread context of 2388 2020 Firefox.exe 34 PID 2020 set thread context of 2872 2020 Firefox.exe 35 -
resource yara_rule behavioral1/memory/2388-48-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2872-61-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2872-58-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2388-54-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2388-51-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2872-63-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2872-66-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2872-62-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2388-69-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2872-70-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2388-71-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2388-73-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2388-76-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/2388-78-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2860 reg.exe 2896 reg.exe 2888 reg.exe 692 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 2388 Firefox.exe Token: SeCreateTokenPrivilege 2388 Firefox.exe Token: SeAssignPrimaryTokenPrivilege 2388 Firefox.exe Token: SeLockMemoryPrivilege 2388 Firefox.exe Token: SeIncreaseQuotaPrivilege 2388 Firefox.exe Token: SeMachineAccountPrivilege 2388 Firefox.exe Token: SeTcbPrivilege 2388 Firefox.exe Token: SeSecurityPrivilege 2388 Firefox.exe Token: SeTakeOwnershipPrivilege 2388 Firefox.exe Token: SeLoadDriverPrivilege 2388 Firefox.exe Token: SeSystemProfilePrivilege 2388 Firefox.exe Token: SeSystemtimePrivilege 2388 Firefox.exe Token: SeProfSingleProcessPrivilege 2388 Firefox.exe Token: SeIncBasePriorityPrivilege 2388 Firefox.exe Token: SeCreatePagefilePrivilege 2388 Firefox.exe Token: SeCreatePermanentPrivilege 2388 Firefox.exe Token: SeBackupPrivilege 2388 Firefox.exe Token: SeRestorePrivilege 2388 Firefox.exe Token: SeShutdownPrivilege 2388 Firefox.exe Token: SeDebugPrivilege 2388 Firefox.exe Token: SeAuditPrivilege 2388 Firefox.exe Token: SeSystemEnvironmentPrivilege 2388 Firefox.exe Token: SeChangeNotifyPrivilege 2388 Firefox.exe Token: SeRemoteShutdownPrivilege 2388 Firefox.exe Token: SeUndockPrivilege 2388 Firefox.exe Token: SeSyncAgentPrivilege 2388 Firefox.exe Token: SeEnableDelegationPrivilege 2388 Firefox.exe Token: SeManageVolumePrivilege 2388 Firefox.exe Token: SeImpersonatePrivilege 2388 Firefox.exe Token: SeCreateGlobalPrivilege 2388 Firefox.exe Token: 31 2388 Firefox.exe Token: 32 2388 Firefox.exe Token: 33 2388 Firefox.exe Token: 34 2388 Firefox.exe Token: 35 2388 Firefox.exe Token: SeDebugPrivilege 2872 Firefox.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 2020 Firefox.exe 2388 Firefox.exe 2388 Firefox.exe 2872 Firefox.exe 2388 Firefox.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2668 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 30 PID 2772 wrote to memory of 2668 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 30 PID 2772 wrote to memory of 2668 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 30 PID 2772 wrote to memory of 2668 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 30 PID 2668 wrote to memory of 2692 2668 cmd.exe 32 PID 2668 wrote to memory of 2692 2668 cmd.exe 32 PID 2668 wrote to memory of 2692 2668 cmd.exe 32 PID 2668 wrote to memory of 2692 2668 cmd.exe 32 PID 2772 wrote to memory of 2020 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 33 PID 2772 wrote to memory of 2020 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 33 PID 2772 wrote to memory of 2020 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 33 PID 2772 wrote to memory of 2020 2772 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 33 PID 2020 wrote to memory of 2388 2020 Firefox.exe 34 PID 2020 wrote to memory of 2388 2020 Firefox.exe 34 PID 2020 wrote to memory of 2388 2020 Firefox.exe 34 PID 2020 wrote to memory of 2388 2020 Firefox.exe 34 PID 2020 wrote to memory of 2388 2020 Firefox.exe 34 PID 2020 wrote to memory of 2388 2020 Firefox.exe 34 PID 2020 wrote to memory of 2388 2020 Firefox.exe 34 PID 2020 wrote to memory of 2388 2020 Firefox.exe 34 PID 2020 wrote to memory of 2388 2020 Firefox.exe 34 PID 2020 wrote to memory of 2872 2020 Firefox.exe 35 PID 2020 wrote to memory of 2872 2020 Firefox.exe 35 PID 2020 wrote to memory of 2872 2020 Firefox.exe 35 PID 2020 wrote to memory of 2872 2020 Firefox.exe 35 PID 2020 wrote to memory of 2872 2020 Firefox.exe 35 PID 2020 wrote to memory of 2872 2020 Firefox.exe 35 PID 2020 wrote to memory of 2872 2020 Firefox.exe 35 PID 2020 wrote to memory of 2872 2020 Firefox.exe 35 PID 2020 wrote to memory of 2872 2020 Firefox.exe 35 PID 2388 wrote to memory of 2044 2388 Firefox.exe 36 PID 2388 wrote to memory of 2044 2388 Firefox.exe 36 PID 2388 wrote to memory of 2044 2388 Firefox.exe 36 PID 2388 wrote to memory of 2044 2388 Firefox.exe 36 PID 2388 wrote to memory of 2184 2388 Firefox.exe 37 PID 2388 wrote to memory of 2184 2388 Firefox.exe 37 PID 2388 wrote to memory of 2184 2388 Firefox.exe 37 PID 2388 wrote to memory of 2184 2388 Firefox.exe 37 PID 2388 wrote to memory of 2396 2388 Firefox.exe 38 PID 2388 wrote to memory of 2396 2388 Firefox.exe 38 PID 2388 wrote to memory of 2396 2388 Firefox.exe 38 PID 2388 wrote to memory of 2396 2388 Firefox.exe 38 PID 2388 wrote to memory of 1840 2388 Firefox.exe 39 PID 2388 wrote to memory of 1840 2388 Firefox.exe 39 PID 2388 wrote to memory of 1840 2388 Firefox.exe 39 PID 2388 wrote to memory of 1840 2388 Firefox.exe 39 PID 2184 wrote to memory of 2888 2184 cmd.exe 44 PID 2184 wrote to memory of 2888 2184 cmd.exe 44 PID 2184 wrote to memory of 2888 2184 cmd.exe 44 PID 2184 wrote to memory of 2888 2184 cmd.exe 44 PID 2044 wrote to memory of 2896 2044 cmd.exe 45 PID 2044 wrote to memory of 2896 2044 cmd.exe 45 PID 2044 wrote to memory of 2896 2044 cmd.exe 45 PID 2044 wrote to memory of 2896 2044 cmd.exe 45 PID 2396 wrote to memory of 2860 2396 cmd.exe 46 PID 2396 wrote to memory of 2860 2396 cmd.exe 46 PID 2396 wrote to memory of 2860 2396 cmd.exe 46 PID 2396 wrote to memory of 2860 2396 cmd.exe 46 PID 1840 wrote to memory of 692 1840 cmd.exe 47 PID 1840 wrote to memory of 692 1840 cmd.exe 47 PID 1840 wrote to memory of 692 1840 cmd.exe 47 PID 1840 wrote to memory of 692 1840 cmd.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe"C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hIYgD.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Updater 3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2692
-
-
-
C:\Users\Admin\AppData\Roaming\Firefox.exe"C:\Users\Admin\AppData\Roaming\Firefox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Roaming\Firefox.exeC:\Users\Admin\AppData\Roaming\Firefox.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:692
-
-
-
-
C:\Users\Admin\AppData\Roaming\Firefox.exeC:\Users\Admin\AppData\Roaming\Firefox.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143B
MD5962bc493b87f298696ad6e3eed7c7937
SHA1985cc0c7e37e2465c4349abd528e120663ebd205
SHA256c167e2faa5307ac291ff833b8a1f5f802eaa028d1aba8d1ad342ca84c07bdb01
SHA5129dd2b755a404b74206b713ab17d2ddedacc48910e942dab71cf7e98d8d25322c24e32648f0881136e5425134aaccfbfd9bdc52ceb4519bd07e97c5564116f173
-
Filesize
1.8MB
MD5a51d5beec038b8fa4f03a66a29e3123a
SHA148b6460532877476160c4a3f9b08a8f1e27e4252
SHA256ee1eeb331a91b17f8f66cda516f32740a3d7d9ebf93f3f5f911885697fdb86b8
SHA512704bf033c66632c1510ce3c66d6d0bf3a3cc13987e4a0b46f30a8b9ab1567d8af49f666dbad8c77a8c56d71f1c593189af2e47416b1eb585436b208835295fc9