Analysis
-
max time kernel
3s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 07:36
Behavioral task
behavioral1
Sample
4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
Resource
win10v2004-20241007-en
General
-
Target
4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
-
Size
1.2MB
-
MD5
eabfbf6bb92e4c50beaf9d5c199ac1f0
-
SHA1
36b0087cbeb2f77dd8067e6d9dd55c005184d312
-
SHA256
4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464
-
SHA512
73b83180bc82f3fa1ab0684b59c542bd7170fc28171341a57b38ee73ddf1db2f1c148366013733d6d793003fea7f0cc14307cdd79a17fa11f84e68692cff4f48
-
SSDEEP
3072:gRRHyoBg8zJRAxuU+N6ET/d9ArfCS3VT62FQwiDefNbaSBVpMQRQ8imgCQIqi/cd:gRhoxrn/vmrqaTh2uMnuPea4g/GcL
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 2 IoCs
resource yara_rule behavioral1/memory/292-310-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/292-324-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2784 set thread context of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 set thread context of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 -
resource yara_rule behavioral1/memory/2784-0-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral1/memory/2784-98-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral1/memory/2784-127-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral1/memory/2784-145-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral1/memory/2988-143-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b00000001225c-180.dat upx behavioral1/memory/1520-182-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral1/memory/2320-290-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/292-310-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2988-305-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2988-317-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1520-314-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral1/memory/2320-321-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/292-324-0x0000000000400000-0x000000000047B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2832 reg.exe 1592 reg.exe 1596 reg.exe 2800 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe 2572 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 2572 svchost.exe 2988 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2572 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 30 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31 PID 2784 wrote to memory of 2988 2784 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2572
-
-
C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2988 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\TSFNE.bat" "3⤵PID:1108
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f4⤵PID:348
-
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"3⤵PID:1520
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:1376
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:2320
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:292
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:888
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:1592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f5⤵PID:1744
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:2832
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:1668
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:1596
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f5⤵PID:876
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:2800
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD5163f8e838efe1d166ffff7408b814e28
SHA152fa0ccba649587e7d24d21d182657078fa6d028
SHA256dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d
-
Filesize
1.2MB
MD5459cf02ce816ce425dd3f1a83b1b151e
SHA1081d9e072310a2b459e93c1f811f093f81a7171c
SHA25683549d791e9eceab7abec53e7b2640b3011bf30f76736ed333237af5483dfbef
SHA512412b9cb74aaa52ecd41fa69b4564a4da9527eee3ced352a91c11fc8f14a6c1861ffedf98075fe1254a93f33f6c98180b59818d265156f79bdb00b3e2c63c1bcd