Analysis
-
max time kernel
119s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe
Resource
win10v2004-20241007-en
General
-
Target
72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe
-
Size
1.8MB
-
MD5
544ee01b78b3c4c3c77cead8b06faee7
-
SHA1
058f7cee673607e34eb438c46d9e5d70af0d8d88
-
SHA256
72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971
-
SHA512
77c90288b39eb199b2a80c308aecb8e4c443903593f3668de26ed29d171850eaf94a82aca95c29cd6dac03364dd5ecefd53c19e23c86c9319e379569d23da754
-
SSDEEP
49152:RNMqQ0kwonLVkZep9nWrPWwONrRoODiGgDWAg2CPaSAnYvJW3BTSXff6YNQVWIP4:RiqQ0kwonLVkZep9nWrPWwONrRoODiGt
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 7 IoCs
resource yara_rule behavioral2/memory/4524-36-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4524-50-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4524-52-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4524-54-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4524-57-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4524-59-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4524-75-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe -
Executes dropped EXE 3 IoCs
pid Process 3424 Firefox.exe 4524 Firefox.exe 2772 Firefox.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater 3 = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3424 set thread context of 4524 3424 Firefox.exe 87 PID 3424 set thread context of 2772 3424 Firefox.exe 89 -
resource yara_rule behavioral2/memory/4524-31-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4524-34-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4524-36-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/2772-38-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2772-42-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2772-45-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4524-50-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/2772-51-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4524-52-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4524-54-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4524-57-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4524-59-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4524-75-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Firefox.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3056 reg.exe 4128 reg.exe 3888 reg.exe 2968 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 4524 Firefox.exe Token: SeCreateTokenPrivilege 4524 Firefox.exe Token: SeAssignPrimaryTokenPrivilege 4524 Firefox.exe Token: SeLockMemoryPrivilege 4524 Firefox.exe Token: SeIncreaseQuotaPrivilege 4524 Firefox.exe Token: SeMachineAccountPrivilege 4524 Firefox.exe Token: SeTcbPrivilege 4524 Firefox.exe Token: SeSecurityPrivilege 4524 Firefox.exe Token: SeTakeOwnershipPrivilege 4524 Firefox.exe Token: SeLoadDriverPrivilege 4524 Firefox.exe Token: SeSystemProfilePrivilege 4524 Firefox.exe Token: SeSystemtimePrivilege 4524 Firefox.exe Token: SeProfSingleProcessPrivilege 4524 Firefox.exe Token: SeIncBasePriorityPrivilege 4524 Firefox.exe Token: SeCreatePagefilePrivilege 4524 Firefox.exe Token: SeCreatePermanentPrivilege 4524 Firefox.exe Token: SeBackupPrivilege 4524 Firefox.exe Token: SeRestorePrivilege 4524 Firefox.exe Token: SeShutdownPrivilege 4524 Firefox.exe Token: SeDebugPrivilege 4524 Firefox.exe Token: SeAuditPrivilege 4524 Firefox.exe Token: SeSystemEnvironmentPrivilege 4524 Firefox.exe Token: SeChangeNotifyPrivilege 4524 Firefox.exe Token: SeRemoteShutdownPrivilege 4524 Firefox.exe Token: SeUndockPrivilege 4524 Firefox.exe Token: SeSyncAgentPrivilege 4524 Firefox.exe Token: SeEnableDelegationPrivilege 4524 Firefox.exe Token: SeManageVolumePrivilege 4524 Firefox.exe Token: SeImpersonatePrivilege 4524 Firefox.exe Token: SeCreateGlobalPrivilege 4524 Firefox.exe Token: 31 4524 Firefox.exe Token: 32 4524 Firefox.exe Token: 33 4524 Firefox.exe Token: 34 4524 Firefox.exe Token: 35 4524 Firefox.exe Token: SeDebugPrivilege 2772 Firefox.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4760 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 3424 Firefox.exe 4524 Firefox.exe 4524 Firefox.exe 2772 Firefox.exe 4524 Firefox.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 4760 wrote to memory of 1120 4760 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 82 PID 4760 wrote to memory of 1120 4760 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 82 PID 4760 wrote to memory of 1120 4760 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 82 PID 1120 wrote to memory of 5000 1120 cmd.exe 85 PID 1120 wrote to memory of 5000 1120 cmd.exe 85 PID 1120 wrote to memory of 5000 1120 cmd.exe 85 PID 4760 wrote to memory of 3424 4760 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 86 PID 4760 wrote to memory of 3424 4760 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 86 PID 4760 wrote to memory of 3424 4760 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe 86 PID 3424 wrote to memory of 4524 3424 Firefox.exe 87 PID 3424 wrote to memory of 4524 3424 Firefox.exe 87 PID 3424 wrote to memory of 4524 3424 Firefox.exe 87 PID 3424 wrote to memory of 4524 3424 Firefox.exe 87 PID 3424 wrote to memory of 4524 3424 Firefox.exe 87 PID 3424 wrote to memory of 4524 3424 Firefox.exe 87 PID 3424 wrote to memory of 4524 3424 Firefox.exe 87 PID 3424 wrote to memory of 4524 3424 Firefox.exe 87 PID 3424 wrote to memory of 2772 3424 Firefox.exe 89 PID 3424 wrote to memory of 2772 3424 Firefox.exe 89 PID 3424 wrote to memory of 2772 3424 Firefox.exe 89 PID 3424 wrote to memory of 2772 3424 Firefox.exe 89 PID 3424 wrote to memory of 2772 3424 Firefox.exe 89 PID 3424 wrote to memory of 2772 3424 Firefox.exe 89 PID 3424 wrote to memory of 2772 3424 Firefox.exe 89 PID 3424 wrote to memory of 2772 3424 Firefox.exe 89 PID 4524 wrote to memory of 2460 4524 Firefox.exe 90 PID 4524 wrote to memory of 2460 4524 Firefox.exe 90 PID 4524 wrote to memory of 2460 4524 Firefox.exe 90 PID 4524 wrote to memory of 1112 4524 Firefox.exe 91 PID 4524 wrote to memory of 1112 4524 Firefox.exe 91 PID 4524 wrote to memory of 1112 4524 Firefox.exe 91 PID 4524 wrote to memory of 684 4524 Firefox.exe 93 PID 4524 wrote to memory of 684 4524 Firefox.exe 93 PID 4524 wrote to memory of 684 4524 Firefox.exe 93 PID 4524 wrote to memory of 2028 4524 Firefox.exe 95 PID 4524 wrote to memory of 2028 4524 Firefox.exe 95 PID 4524 wrote to memory of 2028 4524 Firefox.exe 95 PID 2460 wrote to memory of 3888 2460 cmd.exe 98 PID 2460 wrote to memory of 3888 2460 cmd.exe 98 PID 2460 wrote to memory of 3888 2460 cmd.exe 98 PID 684 wrote to memory of 2968 684 cmd.exe 99 PID 684 wrote to memory of 2968 684 cmd.exe 99 PID 684 wrote to memory of 2968 684 cmd.exe 99 PID 1112 wrote to memory of 3056 1112 cmd.exe 100 PID 1112 wrote to memory of 3056 1112 cmd.exe 100 PID 1112 wrote to memory of 3056 1112 cmd.exe 100 PID 2028 wrote to memory of 4128 2028 cmd.exe 101 PID 2028 wrote to memory of 4128 2028 cmd.exe 101 PID 2028 wrote to memory of 4128 2028 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe"C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mkdsu.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Updater 3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5000
-
-
-
C:\Users\Admin\AppData\Roaming\Firefox.exe"C:\Users\Admin\AppData\Roaming\Firefox.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Roaming\Firefox.exeC:\Users\Admin\AppData\Roaming\Firefox.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3056
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2968
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4128
-
-
-
-
C:\Users\Admin\AppData\Roaming\Firefox.exeC:\Users\Admin\AppData\Roaming\Firefox.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2772
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143B
MD5962bc493b87f298696ad6e3eed7c7937
SHA1985cc0c7e37e2465c4349abd528e120663ebd205
SHA256c167e2faa5307ac291ff833b8a1f5f802eaa028d1aba8d1ad342ca84c07bdb01
SHA5129dd2b755a404b74206b713ab17d2ddedacc48910e942dab71cf7e98d8d25322c24e32648f0881136e5425134aaccfbfd9bdc52ceb4519bd07e97c5564116f173
-
Filesize
1.8MB
MD5cbfa13fc592d091e803ec16a51ad32fc
SHA1dac8f4f3fcd4b11570bfc472aa7386699fad6ed5
SHA256923a79db974983f16a99ed664ec4853e604508fbc2f2f5976d4eb588b5b4f344
SHA512aeac78c3b3b6595f414a8934b857f5cd8c4f2b3d090c6ffc5d739e57beb9648b4275306ac2ad2029903cb10ebd5b83a591a0a075bc3ca14c057c61b1997b48ff