Analysis
-
max time kernel
3s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/02/2025, 16:24
Behavioral task
behavioral1
Sample
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe
Resource
win10v2004-20250211-en
General
-
Target
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe
-
Size
405KB
-
MD5
e6d662693685c5bfcf88a842d2853cdc
-
SHA1
817f5bb381616bf4279ccbffe884d1e8d87e078a
-
SHA256
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546
-
SHA512
56720bfa6ea50b38cf53ee27ba43ec868931adf54dc5c069b3a1d0d8055d032844b3dbab5f1d41d223ca821d6f5985a9ae859be97dd58df6bd8a67eacb960a98
-
SSDEEP
6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJr+:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xS1
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 2 IoCs
resource yara_rule behavioral1/memory/2052-309-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2052-323-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2372 set thread context of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 set thread context of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 -
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2372-26-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2372-99-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2372-129-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2372-128-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2372-146-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2892-144-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000d00000001226a-173.dat upx behavioral1/memory/1696-182-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2892-292-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1760-291-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1696-311-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2892-317-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2052-309-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1760-320-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2052-323-0x0000000000400000-0x000000000047B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1560 reg.exe 2688 reg.exe 2792 reg.exe 1592 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 2848 svchost.exe 2892 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2848 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 30 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31 PID 2372 wrote to memory of 2892 2372 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2892 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\TSGHC.bat" "3⤵PID:2172
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f4⤵PID:264
-
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"3⤵PID:1696
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:2972
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:1760
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:2052
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:2632
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f5⤵PID:688
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:2792
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:344
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:2688
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f5⤵PID:2912
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:1592
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD5163f8e838efe1d166ffff7408b814e28
SHA152fa0ccba649587e7d24d21d182657078fa6d028
SHA256dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d
-
Filesize
405KB
MD56fabb03235bc0b089a4f32b6a3283fea
SHA1627a8f35eea6f5e15ae4c71596c52b78fe7c3596
SHA25663034418764763cf0c819a07eb5acaf0ace29ce8a611f8706eec2f4a98061c99
SHA512a4b6e417b7c3a4f4152bff80f106699df0b5d342884c300014806304053f092b1cbe68cb0f454b8e2c7e8a962783daa9be26b130d2f2c594cdcb6c68d384cbe5