Analysis
-
max time kernel
6s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 07:36
Behavioral task
behavioral1
Sample
4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
Resource
win10v2004-20241007-en
General
-
Target
4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
-
Size
1.2MB
-
MD5
eabfbf6bb92e4c50beaf9d5c199ac1f0
-
SHA1
36b0087cbeb2f77dd8067e6d9dd55c005184d312
-
SHA256
4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464
-
SHA512
73b83180bc82f3fa1ab0684b59c542bd7170fc28171341a57b38ee73ddf1db2f1c148366013733d6d793003fea7f0cc14307cdd79a17fa11f84e68692cff4f48
-
SSDEEP
3072:gRRHyoBg8zJRAxuU+N6ET/d9ArfCS3VT62FQwiDefNbaSBVpMQRQ8imgCQIqi/cd:gRhoxrn/vmrqaTh2uMnuPea4g/GcL
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 10 IoCs
resource yara_rule behavioral2/memory/1076-64-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1076-77-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1076-79-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1076-82-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1076-84-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1076-86-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1076-89-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1076-91-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1076-93-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1076-98-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe -
Executes dropped EXE 1 IoCs
pid Process 2224 javaruntime.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3920 set thread context of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 set thread context of 4548 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 84 -
resource yara_rule behavioral2/memory/3920-0-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/3920-13-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/4548-16-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4548-18-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3920-21-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/4548-14-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023ca0-35.dat upx behavioral2/memory/2224-46-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/4548-53-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2224-70-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/1076-64-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-63-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-61-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/4548-73-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/5092-74-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1076-77-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-79-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-82-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-84-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-86-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-89-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-91-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-93-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1076-98-0x0000000000400000-0x000000000047B000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\javaruntime.exe 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe File opened for modification C:\Windows\javaruntime.exe 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaruntime.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4868 reg.exe 1424 reg.exe 4592 reg.exe 1412 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 1988 svchost.exe 4548 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 2224 javaruntime.exe 2224 javaruntime.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3920 wrote to memory of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 wrote to memory of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 wrote to memory of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 wrote to memory of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 wrote to memory of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 wrote to memory of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 wrote to memory of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 wrote to memory of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 wrote to memory of 1988 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 83 PID 3920 wrote to memory of 4548 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 84 PID 3920 wrote to memory of 4548 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 84 PID 3920 wrote to memory of 4548 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 84 PID 3920 wrote to memory of 4548 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 84 PID 3920 wrote to memory of 4548 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 84 PID 3920 wrote to memory of 4548 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 84 PID 3920 wrote to memory of 4548 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 84 PID 3920 wrote to memory of 4548 3920 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 84 PID 4548 wrote to memory of 4684 4548 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 85 PID 4548 wrote to memory of 4684 4548 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 85 PID 4548 wrote to memory of 4684 4548 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 85 PID 4684 wrote to memory of 5112 4684 cmd.exe 89 PID 4684 wrote to memory of 5112 4684 cmd.exe 89 PID 4684 wrote to memory of 5112 4684 cmd.exe 89 PID 4548 wrote to memory of 2224 4548 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 90 PID 4548 wrote to memory of 2224 4548 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 90 PID 4548 wrote to memory of 2224 4548 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BMOJH.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5112
-
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2224 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:2996
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:5092
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:1076
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:3848
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:4592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f5⤵PID:3120
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:1424
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:4032
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:4868
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f5⤵PID:1892
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:1412
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD5163f8e838efe1d166ffff7408b814e28
SHA152fa0ccba649587e7d24d21d182657078fa6d028
SHA256dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d
-
Filesize
1.2MB
MD504a87c84b3965e19ee437f4e846c87bb
SHA13470c2a0b7fd3def145c6f0b8cc04f2fa68d6ac1
SHA2561694d01bf45b9992ef1ecfec3593c7d7fcd04a83d924e885be293fec817e60a0
SHA512f49bc0a7eb66fbefdf270caa25a034ae5d81f0110bc45533449eeff3ad65f5744f1e772c27e8357a597d298ddcf44e565f01ac6cf104bd23c5e54033142a302d