blackshades | 159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905

Analysis

max time kernel
3s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-02-2025 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
Size

405KB
MD5

6d6ded5c29c54d37ed5e481270d0cb20
SHA1

70a2ba22881f9d2c02cc65d801a04f18b39bd359
SHA256

159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905
SHA512

dedbda5b25762844417fec10fa3134749781911c44d6294fd9c1a2f80286ad239f46c39f22ca53fe9d4e18c2a9e3aff32f433c5d2a0ab167d2d2349b437625c8
SSDEEP

6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJr7:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xSG

Score

10^/10

blackshades discovery rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 2 IoCs

resource	yara_rule
behavioral1/memory/2400-315-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral1/memory/2400-323-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 set thread context of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/1680-26-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/1680-99-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/1680-129-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/1680-141-0x0000000002BD0000-0x0000000002CFD000-memory.dmp	upx
behavioral1/memory/1572-144-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1680-147-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/1680-128-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/1572-173-0x0000000003290000-0x00000000033BD000-memory.dmp	upx
behavioral1/files/0x00090000000120fb-174.dat	upx
behavioral1/memory/1832-183-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2416-291-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1572-292-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2400-315-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1572-314-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1832-311-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral1/memory/2416-322-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2400-323-0x0000000000400000-0x000000000047B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1216	reg.exe
2272	reg.exe
2500	reg.exe
576	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe
2608	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
2608	svchost.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 2608	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	30
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31
PID 1680 wrote to memory of 1572	1680	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	31

C:\Users\Admin\AppData\Local\Temp\159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
"C:\Users\Admin\AppData\Local\Temp\159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
  "C:\Users\Admin\AppData\Local\Temp\159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\BXWAN.bat" "
    3⤵
    PID:768
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f
      4⤵
      PID:2104
- - C:\Windows\javaruntime.exe
    "C:\Windows\javaruntime.exe"
    3⤵
    PID:1832
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:1316
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      PID:2416
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      PID:2400
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:2148
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies registry key
        
        PID:2272
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:2208
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies registry key
        
        PID:576
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:1496
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies registry key
        
        PID:2500
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:2508
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies registry key
        
        PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BXWAN.bat

Filesize
124B

MD5
163f8e838efe1d166ffff7408b814e28

SHA1
52fa0ccba649587e7d24d21d182657078fa6d028

SHA256
dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7

SHA512
b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

Download Submit
C:\Windows\javaruntime.exe

Filesize
405KB

MD5
2cc3c55cb6625a6a8d97d16c7b48246b

SHA1
26ad880bff29ca099b89c83bfe54a4ebd533cbc1

SHA256
62f80d376829335ead0484376d592bc42ee82e721f172d0cae1d7fc86e15aa88

SHA512
614a990f7b40e5ce92c2446ec451aa3b862008e63b05eecb605bfb2f68bebc3509dcfc1a1195830adc549058596eea8f665f45634dc308d1757211194bbbaaa9

Download Submit
memory/1572-144-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1572-314-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1572-292-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1572-180-0x0000000003290000-0x00000000033BD000-memory.dmp

Filesize
1.2MB

Download
memory/1572-173-0x0000000003290000-0x00000000033BD000-memory.dmp

Filesize
1.2MB

Download
memory/1572-133-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1680-61-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1680-5-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1680-71-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1680-0-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1680-41-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1680-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1680-15-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1680-79-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/1680-26-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1680-25-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/1680-29-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1680-128-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1680-99-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1680-142-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/1680-147-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1680-129-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1680-141-0x0000000002BD0000-0x0000000002CFD000-memory.dmp

Filesize
1.2MB

Download
memory/1680-89-0x0000000001D80000-0x0000000001D81000-memory.dmp

Filesize
4KB

Download
memory/1832-183-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1832-311-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1832-290-0x0000000002B10000-0x0000000002C3D000-memory.dmp

Filesize
1.2MB

Download
memory/2400-323-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2400-315-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2416-322-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2416-291-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2608-181-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2608-106-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2608-119-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2608-123-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2608-118-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2608-110-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2608-116-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2608-104-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2608-114-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2608-112-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2608-109-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download