blackshades | a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232

Analysis

max time kernel
3s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-02-2025 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe
Size

405KB
MD5

ba05f63495275d500a036d9cc3fac719
SHA1

c09f64f558278b347500365e391c3bd2e578a251
SHA256

a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232
SHA512

fc0cc951f22565ed035b347a894de4a4907177f4ac78b3b09f54618d20e5149104ba9068d81d8b13c658940aceac84021bbb314ebd6d33ffad709623ac9f16a2
SSDEEP

6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJrB:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xSC

Score

10^/10

blackshades discovery rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 1 IoCs

resource	yara_rule
behavioral1/memory/776-323-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 set thread context of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2312-0-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2312-26-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2312-99-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2312-129-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2312-128-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2312-147-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2280-144-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2280-136-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2280-173-0x0000000003710000-0x000000000383D000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-181.dat	upx
behavioral1/memory/3056-182-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2280-289-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2216-293-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/776-309-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/2280-314-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/3056-311-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2216-322-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/776-323-0x0000000000400000-0x000000000047B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1756	reg.exe
1516	reg.exe
1512	reg.exe
1896	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe
3044	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe
3044	svchost.exe
2280	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 3044	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	31
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32
PID 2312 wrote to memory of 2280	2312	a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe	32

C:\Users\Admin\AppData\Local\Temp\a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe
"C:\Users\Admin\AppData\Local\Temp\a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe
  "C:\Users\Admin\AppData\Local\Temp\a915a001996f2f151520c9690004332595b7497b7e9e9caf5adb41f36af2e232.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\ULAVR.bat" "
    3⤵
    PID:1492
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f
      4⤵
      PID:2716
- - C:\Windows\javaruntime.exe
    "C:\Windows\javaruntime.exe"
    3⤵
    PID:3056
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:700
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      PID:2216
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      PID:776
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:872
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies registry key
        
        PID:1512
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:2120
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies registry key
        
        PID:1516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:3008
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies registry key
        
        PID:1896
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:2340
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies registry key
        
        PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ULAVR.bat

Filesize
124B

MD5
163f8e838efe1d166ffff7408b814e28

SHA1
52fa0ccba649587e7d24d21d182657078fa6d028

SHA256
dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7

SHA512
b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

Download Submit
C:\Windows\javaruntime.exe

Filesize
405KB

MD5
e6dde5a1a45fc95179eaa31820fde604

SHA1
5ef689e87739d380fd9c89a51739eae722e99e24

SHA256
c4aef2498e4cd7b0ea8ee75aa09c87aa13abcbfac805a44995ca4e763a483075

SHA512
15d777e046d9b4fb6efd5652965f2fd22cc39009b7bd98c698faeb65e5c4c8d8734832e20f4a91e8f01244758b2c8679fe89c9daa6565c978293c087da6a7948

Download Submit
memory/776-323-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/776-309-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2216-322-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2216-293-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2280-144-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2280-314-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2280-289-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2280-173-0x0000000003710000-0x000000000383D000-memory.dmp

Filesize
1.2MB

Download
memory/2280-135-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2280-136-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2312-41-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/2312-79-0x0000000002430000-0x0000000002432000-memory.dmp

Filesize
8KB

Download
memory/2312-5-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2312-3-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2312-23-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/2312-15-0x0000000001C50000-0x0000000001C51000-memory.dmp

Filesize
4KB

Download
memory/2312-26-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2312-99-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2312-89-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/2312-71-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/2312-129-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2312-133-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/2312-128-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2312-143-0x0000000002AF0000-0x0000000002C1D000-memory.dmp

Filesize
1.2MB

Download
memory/2312-147-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2312-29-0x0000000001C70000-0x0000000001C71000-memory.dmp

Filesize
4KB

Download
memory/2312-0-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2312-61-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/3044-106-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3044-122-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3044-180-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3044-110-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3044-104-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3044-112-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3044-114-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3044-108-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3044-116-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3044-118-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3056-182-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3056-311-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3056-308-0x00000000032A0000-0x00000000033CD000-memory.dmp

Filesize
1.2MB

Download
memory/3056-291-0x00000000032A0000-0x00000000033CD000-memory.dmp

Filesize
1.2MB

Download