Analysis
-
max time kernel
119s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 13:11
Behavioral task
behavioral1
Sample
0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe
Resource
win10v2004-20241007-en
General
-
Target
0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe
-
Size
1.5MB
-
MD5
93e6a9ffe500c907cf198a2dde600260
-
SHA1
e419285cf1d637faab23fbb3abcc11aa1a696340
-
SHA256
0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654
-
SHA512
53dacc2e1b5c704e589d257747e031c5368f1dade643f1b989cd91b503ec87dc846abcbb3f6f9643f70a54f8238bab395a2e3393cea9697fa3bdc854a369fae8
-
SSDEEP
12288:Y+Qf9NxkERr1JzrDTzz7wHxhW88KH6Yn77TCNp8jToZGrhR0ZooSl:Ox0j8KaYnfTYp8/oZMGZi
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 9 IoCs
resource yara_rule behavioral2/memory/4736-35-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4736-40-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4736-38-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4736-52-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4736-54-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4736-56-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4736-59-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4736-61-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4736-77-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe -
Executes dropped EXE 3 IoCs
pid Process 2964 winlogon.exe 4736 winlogon.exe 4316 winlogon.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2964 set thread context of 4736 2964 winlogon.exe 87 PID 2964 set thread context of 4316 2964 winlogon.exe 88 -
resource yara_rule behavioral2/memory/3140-0-0x0000000000400000-0x000000000058F000-memory.dmp upx behavioral2/files/0x0008000000023c60-16.dat upx behavioral2/memory/3140-29-0x0000000000400000-0x000000000058F000-memory.dmp upx behavioral2/memory/4736-35-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4736-31-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4736-34-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4736-40-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4316-47-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4316-50-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4316-46-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2964-51-0x0000000000400000-0x000000000058F000-memory.dmp upx behavioral2/memory/4316-41-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4736-38-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4736-52-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4316-53-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4736-54-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4736-56-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4736-59-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4736-61-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4736-77-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4948 reg.exe 3708 reg.exe 3552 reg.exe 4884 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 4736 winlogon.exe Token: SeCreateTokenPrivilege 4736 winlogon.exe Token: SeAssignPrimaryTokenPrivilege 4736 winlogon.exe Token: SeLockMemoryPrivilege 4736 winlogon.exe Token: SeIncreaseQuotaPrivilege 4736 winlogon.exe Token: SeMachineAccountPrivilege 4736 winlogon.exe Token: SeTcbPrivilege 4736 winlogon.exe Token: SeSecurityPrivilege 4736 winlogon.exe Token: SeTakeOwnershipPrivilege 4736 winlogon.exe Token: SeLoadDriverPrivilege 4736 winlogon.exe Token: SeSystemProfilePrivilege 4736 winlogon.exe Token: SeSystemtimePrivilege 4736 winlogon.exe Token: SeProfSingleProcessPrivilege 4736 winlogon.exe Token: SeIncBasePriorityPrivilege 4736 winlogon.exe Token: SeCreatePagefilePrivilege 4736 winlogon.exe Token: SeCreatePermanentPrivilege 4736 winlogon.exe Token: SeBackupPrivilege 4736 winlogon.exe Token: SeRestorePrivilege 4736 winlogon.exe Token: SeShutdownPrivilege 4736 winlogon.exe Token: SeDebugPrivilege 4736 winlogon.exe Token: SeAuditPrivilege 4736 winlogon.exe Token: SeSystemEnvironmentPrivilege 4736 winlogon.exe Token: SeChangeNotifyPrivilege 4736 winlogon.exe Token: SeRemoteShutdownPrivilege 4736 winlogon.exe Token: SeUndockPrivilege 4736 winlogon.exe Token: SeSyncAgentPrivilege 4736 winlogon.exe Token: SeEnableDelegationPrivilege 4736 winlogon.exe Token: SeManageVolumePrivilege 4736 winlogon.exe Token: SeImpersonatePrivilege 4736 winlogon.exe Token: SeCreateGlobalPrivilege 4736 winlogon.exe Token: 31 4736 winlogon.exe Token: 32 4736 winlogon.exe Token: 33 4736 winlogon.exe Token: 34 4736 winlogon.exe Token: 35 4736 winlogon.exe Token: SeDebugPrivilege 4316 winlogon.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3140 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe 2964 winlogon.exe 4736 winlogon.exe 4736 winlogon.exe 4316 winlogon.exe 4736 winlogon.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 3140 wrote to memory of 1272 3140 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe 82 PID 3140 wrote to memory of 1272 3140 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe 82 PID 3140 wrote to memory of 1272 3140 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe 82 PID 1272 wrote to memory of 1176 1272 cmd.exe 85 PID 1272 wrote to memory of 1176 1272 cmd.exe 85 PID 1272 wrote to memory of 1176 1272 cmd.exe 85 PID 3140 wrote to memory of 2964 3140 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe 86 PID 3140 wrote to memory of 2964 3140 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe 86 PID 3140 wrote to memory of 2964 3140 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe 86 PID 2964 wrote to memory of 4736 2964 winlogon.exe 87 PID 2964 wrote to memory of 4736 2964 winlogon.exe 87 PID 2964 wrote to memory of 4736 2964 winlogon.exe 87 PID 2964 wrote to memory of 4736 2964 winlogon.exe 87 PID 2964 wrote to memory of 4736 2964 winlogon.exe 87 PID 2964 wrote to memory of 4736 2964 winlogon.exe 87 PID 2964 wrote to memory of 4736 2964 winlogon.exe 87 PID 2964 wrote to memory of 4736 2964 winlogon.exe 87 PID 2964 wrote to memory of 4316 2964 winlogon.exe 88 PID 2964 wrote to memory of 4316 2964 winlogon.exe 88 PID 2964 wrote to memory of 4316 2964 winlogon.exe 88 PID 2964 wrote to memory of 4316 2964 winlogon.exe 88 PID 2964 wrote to memory of 4316 2964 winlogon.exe 88 PID 2964 wrote to memory of 4316 2964 winlogon.exe 88 PID 2964 wrote to memory of 4316 2964 winlogon.exe 88 PID 2964 wrote to memory of 4316 2964 winlogon.exe 88 PID 4736 wrote to memory of 800 4736 winlogon.exe 89 PID 4736 wrote to memory of 800 4736 winlogon.exe 89 PID 4736 wrote to memory of 800 4736 winlogon.exe 89 PID 4736 wrote to memory of 1092 4736 winlogon.exe 90 PID 4736 wrote to memory of 1092 4736 winlogon.exe 90 PID 4736 wrote to memory of 1092 4736 winlogon.exe 90 PID 4736 wrote to memory of 2456 4736 winlogon.exe 91 PID 4736 wrote to memory of 2456 4736 winlogon.exe 91 PID 4736 wrote to memory of 2456 4736 winlogon.exe 91 PID 4736 wrote to memory of 3248 4736 winlogon.exe 92 PID 4736 wrote to memory of 3248 4736 winlogon.exe 92 PID 4736 wrote to memory of 3248 4736 winlogon.exe 92 PID 800 wrote to memory of 3708 800 cmd.exe 97 PID 800 wrote to memory of 3708 800 cmd.exe 97 PID 800 wrote to memory of 3708 800 cmd.exe 97 PID 3248 wrote to memory of 4884 3248 cmd.exe 98 PID 3248 wrote to memory of 4884 3248 cmd.exe 98 PID 3248 wrote to memory of 4884 3248 cmd.exe 98 PID 1092 wrote to memory of 3552 1092 cmd.exe 99 PID 1092 wrote to memory of 3552 1092 cmd.exe 99 PID 1092 wrote to memory of 3552 1092 cmd.exe 99 PID 2456 wrote to memory of 4948 2456 cmd.exe 100 PID 2456 wrote to memory of 4948 2456 cmd.exe 100 PID 2456 wrote to memory of 4948 2456 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe"C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GQyqJ.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1176
-
-
-
C:\Users\Admin\AppData\Roaming\winlogon.exe"C:\Users\Admin\AppData\Roaming\winlogon.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Roaming\winlogon.exeC:\Users\Admin\AppData\Roaming\winlogon.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3708
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4948
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4884
-
-
-
-
C:\Users\Admin\AppData\Roaming\winlogon.exeC:\Users\Admin\AppData\Roaming\winlogon.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4316
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138B
MD54da6717f2c70f4bd32ad33a227a2ff47
SHA13d7f7159e1f695bd469287d1ad4ffa0841b407a8
SHA256a12bb2e5d2fb0b3c400ce311fae72995a00b57a97d23e4b9effec47cff189d07
SHA5126765314054ad9bf2164058248f3d3a17775176925abbe4376aec030dca3a5e59be8b9e96139941fec2b2e1a9bff38f87abdb29ea09a299d8ab7e23ecec4083df
-
Filesize
1.5MB
MD5ee8c15322d0385bf2df66a275c842cb2
SHA1dde0ccd1dad7f04c307906578aa7fd7cedb32bd3
SHA25615213f61ae910e29cba3623bfbc1d26c5a539a76b851ce895fe39dc228760274
SHA512b5969d19a492d7fd8662bf3d3d45d31134709796b57bdcfa444a081bf0619898de3dea970c48070c07e940492d5eada4056db625cfad68bba1f3b3b7e3925371