Analysis
-
max time kernel
3s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/02/2025, 16:20
Behavioral task
behavioral1
Sample
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe
Resource
win10v2004-20250211-en
General
-
Target
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe
-
Size
405KB
-
MD5
e6d662693685c5bfcf88a842d2853cdc
-
SHA1
817f5bb381616bf4279ccbffe884d1e8d87e078a
-
SHA256
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546
-
SHA512
56720bfa6ea50b38cf53ee27ba43ec868931adf54dc5c069b3a1d0d8055d032844b3dbab5f1d41d223ca821d6f5985a9ae859be97dd58df6bd8a67eacb960a98
-
SSDEEP
6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJr+:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xS1
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 2 IoCs
resource yara_rule behavioral1/memory/2468-311-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2468-326-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3060 set thread context of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 set thread context of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 -
resource yara_rule behavioral1/memory/3060-0-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/3060-80-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/3060-100-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/3060-99-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/3060-129-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/640-146-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3060-143-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/files/0x0008000000018731-172.dat upx behavioral1/memory/2492-182-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/640-178-0x0000000003220000-0x000000000334D000-memory.dmp upx behavioral1/memory/640-291-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2468-311-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2492-313-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/640-322-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2240-323-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2468-326-0x0000000000400000-0x000000000047B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2420 reg.exe 2072 reg.exe 2384 reg.exe 1860 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe 2532 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 2532 svchost.exe 640 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 2532 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 3060 wrote to memory of 640 3060 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:640 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CWAXL.bat" "3⤵PID:2452
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f4⤵PID:1068
-
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"3⤵PID:2492
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:1700
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:2240
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:2468
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:2008
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:2072
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f5⤵PID:2984
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:2384
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:2352
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:1860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f5⤵PID:2152
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:2420
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD5163f8e838efe1d166ffff7408b814e28
SHA152fa0ccba649587e7d24d21d182657078fa6d028
SHA256dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d
-
Filesize
405KB
MD514c2c4093e3c5c0bce604879fe7a84c9
SHA1e4e90ff2edb63a25d48e338ef94bea4af743a826
SHA256b2551d10e3a3bef85a011351b68ce7bfdd6d730bb28fac1e3ea22c98b4e6f8ae
SHA5124eb08f698f5cc7f309f46b5d0a7582fa9a959d800a910c48bf5e5aee3bf9b6b8203b76273575d4440c70201d367c5d17dc2bf6f9770064adf8dff1054e0be846