blackshades | c352321f7e1d461d1d9b24d2928610b28aa780df2d24441adf800543258f7c55

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 15:00

Target

JaffaCakes118_4c2fc38376c698e985d1f16cd5ecaa1f.exe
Size

681KB
MD5

4c2fc38376c698e985d1f16cd5ecaa1f
SHA1

0d3aecd6345ce623b494ded25b526841e93f1827
SHA256

c352321f7e1d461d1d9b24d2928610b28aa780df2d24441adf800543258f7c55
SHA512

b5702bdd9762d6be94de6c9f7b059198e62fee46abca591a738f038c282c4cc3cc4dde39dc50c0fd0bd6d8490d675486213df3fe44dd71197c1eedfd0390c503
SSDEEP

12288:9uuNyUaTabVPyun+L3OgrXemFg4M9cEUzLX8BcdxL7:wcy/2dyjOwX5g4MqEoDCuV

Score

10^/10

blackshades rat

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 1 IoCs

resource	yara_rule
behavioral1/memory/1848-2-0x000000001A6A0000-0x000000001A700000-memory.dmp	family_blackshades

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2404	1848	JaffaCakes118_4c2fc38376c698e985d1f16cd5ecaa1f.exe	30
PID 1848 wrote to memory of 2404	1848	JaffaCakes118_4c2fc38376c698e985d1f16cd5ecaa1f.exe	30
PID 1848 wrote to memory of 2404	1848	JaffaCakes118_4c2fc38376c698e985d1f16cd5ecaa1f.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c2fc38376c698e985d1f16cd5ecaa1f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c2fc38376c698e985d1f16cd5ecaa1f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1848 -s 628
  2⤵
  PID:2404

memory/1848-0-0x000007FEF6533000-0x000007FEF6534000-memory.dmp

Filesize
4KB

Download
memory/1848-1-0x00000000002A0000-0x0000000000350000-memory.dmp

Filesize
704KB

Download
memory/1848-2-0x000000001A6A0000-0x000000001A700000-memory.dmp

Filesize
384KB

Download
memory/1848-3-0x000007FEF6530000-0x000007FEF6F1C000-memory.dmp

Filesize
9.9MB

Download
memory/1848-4-0x000007FEF6530000-0x000007FEF6F1C000-memory.dmp

Filesize
9.9MB

Download