Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
14/02/2025, 07:42
Static task
static1
Behavioral task
behavioral1
Sample
Anonymous DoSer.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Anonymous DoSer.exe
Resource
win10v2004-20250207-en
General
-
Target
Anonymous DoSer.exe
-
Size
601KB
-
MD5
b86e117d120264bf7d165ed578843510
-
SHA1
e58eabd02b51b5c2ff150ec45fdecf5430ee43ca
-
SHA256
e94454d2825d2bf6a1580988162767d29ab0a73589aee93fd9183d81fdd6c307
-
SHA512
c745b197dfc560e1a1e492fabf6c088e480a5c5e6ed1a405ac7a2ec7060c20b115735f7d8208b5f5fef5b7bc9f9116f279f7acb86b50d4266ff28b39533a75be
-
SSDEEP
12288:w7Spt6JMt1HOuS3lPvTX8u/CdrnW952xSHriovgvgYVK8h/quFt:w7S/6q/HOjPrN8nWnwSngvUEB
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 16 IoCs
resource yara_rule behavioral1/memory/2000-16-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-12-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-29-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-30-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-32-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-33-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-34-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-35-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-37-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-38-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-40-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-41-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-42-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-44-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-45-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral1/memory/2000-46-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\DDos.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DDos.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Executes dropped EXE 1 IoCs
pid Process 2620 1412955739.exe -
Loads dropped DLL 1 IoCs
pid Process 2628 Anonymous DoSer.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2628 set thread context of 2000 2628 Anonymous DoSer.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1412955739.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anonymous DoSer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3048 reg.exe 2852 reg.exe 2864 reg.exe 3024 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2628 Anonymous DoSer.exe Token: 1 2000 vbc.exe Token: SeCreateTokenPrivilege 2000 vbc.exe Token: SeAssignPrimaryTokenPrivilege 2000 vbc.exe Token: SeLockMemoryPrivilege 2000 vbc.exe Token: SeIncreaseQuotaPrivilege 2000 vbc.exe Token: SeMachineAccountPrivilege 2000 vbc.exe Token: SeTcbPrivilege 2000 vbc.exe Token: SeSecurityPrivilege 2000 vbc.exe Token: SeTakeOwnershipPrivilege 2000 vbc.exe Token: SeLoadDriverPrivilege 2000 vbc.exe Token: SeSystemProfilePrivilege 2000 vbc.exe Token: SeSystemtimePrivilege 2000 vbc.exe Token: SeProfSingleProcessPrivilege 2000 vbc.exe Token: SeIncBasePriorityPrivilege 2000 vbc.exe Token: SeCreatePagefilePrivilege 2000 vbc.exe Token: SeCreatePermanentPrivilege 2000 vbc.exe Token: SeBackupPrivilege 2000 vbc.exe Token: SeRestorePrivilege 2000 vbc.exe Token: SeShutdownPrivilege 2000 vbc.exe Token: SeDebugPrivilege 2000 vbc.exe Token: SeAuditPrivilege 2000 vbc.exe Token: SeSystemEnvironmentPrivilege 2000 vbc.exe Token: SeChangeNotifyPrivilege 2000 vbc.exe Token: SeRemoteShutdownPrivilege 2000 vbc.exe Token: SeUndockPrivilege 2000 vbc.exe Token: SeSyncAgentPrivilege 2000 vbc.exe Token: SeEnableDelegationPrivilege 2000 vbc.exe Token: SeManageVolumePrivilege 2000 vbc.exe Token: SeImpersonatePrivilege 2000 vbc.exe Token: SeCreateGlobalPrivilege 2000 vbc.exe Token: 31 2000 vbc.exe Token: 32 2000 vbc.exe Token: 33 2000 vbc.exe Token: 34 2000 vbc.exe Token: 35 2000 vbc.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2000 vbc.exe 2000 vbc.exe 2000 vbc.exe 2000 vbc.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2620 2628 Anonymous DoSer.exe 30 PID 2628 wrote to memory of 2620 2628 Anonymous DoSer.exe 30 PID 2628 wrote to memory of 2620 2628 Anonymous DoSer.exe 30 PID 2628 wrote to memory of 2620 2628 Anonymous DoSer.exe 30 PID 2628 wrote to memory of 2000 2628 Anonymous DoSer.exe 32 PID 2628 wrote to memory of 2000 2628 Anonymous DoSer.exe 32 PID 2628 wrote to memory of 2000 2628 Anonymous DoSer.exe 32 PID 2628 wrote to memory of 2000 2628 Anonymous DoSer.exe 32 PID 2628 wrote to memory of 2000 2628 Anonymous DoSer.exe 32 PID 2628 wrote to memory of 2000 2628 Anonymous DoSer.exe 32 PID 2628 wrote to memory of 2000 2628 Anonymous DoSer.exe 32 PID 2628 wrote to memory of 2000 2628 Anonymous DoSer.exe 32 PID 2000 wrote to memory of 2940 2000 vbc.exe 33 PID 2000 wrote to memory of 2940 2000 vbc.exe 33 PID 2000 wrote to memory of 2940 2000 vbc.exe 33 PID 2000 wrote to memory of 2940 2000 vbc.exe 33 PID 2000 wrote to memory of 2944 2000 vbc.exe 34 PID 2000 wrote to memory of 2944 2000 vbc.exe 34 PID 2000 wrote to memory of 2944 2000 vbc.exe 34 PID 2000 wrote to memory of 2944 2000 vbc.exe 34 PID 2000 wrote to memory of 2960 2000 vbc.exe 36 PID 2000 wrote to memory of 2960 2000 vbc.exe 36 PID 2000 wrote to memory of 2960 2000 vbc.exe 36 PID 2000 wrote to memory of 2960 2000 vbc.exe 36 PID 2000 wrote to memory of 2936 2000 vbc.exe 37 PID 2000 wrote to memory of 2936 2000 vbc.exe 37 PID 2000 wrote to memory of 2936 2000 vbc.exe 37 PID 2000 wrote to memory of 2936 2000 vbc.exe 37 PID 2936 wrote to memory of 2852 2936 cmd.exe 41 PID 2936 wrote to memory of 2852 2936 cmd.exe 41 PID 2936 wrote to memory of 2852 2936 cmd.exe 41 PID 2936 wrote to memory of 2852 2936 cmd.exe 41 PID 2940 wrote to memory of 3048 2940 cmd.exe 42 PID 2940 wrote to memory of 3048 2940 cmd.exe 42 PID 2940 wrote to memory of 3048 2940 cmd.exe 42 PID 2940 wrote to memory of 3048 2940 cmd.exe 42 PID 2944 wrote to memory of 3024 2944 cmd.exe 43 PID 2944 wrote to memory of 3024 2944 cmd.exe 43 PID 2944 wrote to memory of 3024 2944 cmd.exe 43 PID 2944 wrote to memory of 3024 2944 cmd.exe 43 PID 2960 wrote to memory of 2864 2960 cmd.exe 44 PID 2960 wrote to memory of 2864 2960 cmd.exe 44 PID 2960 wrote to memory of 2864 2960 cmd.exe 44 PID 2960 wrote to memory of 2864 2960 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\Anonymous DoSer.exe"C:\Users\Admin\AppData\Local\Temp\Anonymous DoSer.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\1412955739.exe"C:\Users\Admin\AppData\Local\Temp\1412955739.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2620
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3048
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2864
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DDos.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DDos.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DDos.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DDos.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2852
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
278KB
MD5270f2f56af0de91cc5f0b83ed241851b
SHA17b0ea98bb83ca8be24e62b2f68133f43867e6403
SHA2561a9e73e0e877edd16882dcc866467e7ee817efad6ef68a7de82c2c12b2e566fe
SHA512b8b4b06503cbc9da38a898088f8031b44ee0e4dd415f2ab853b360fd3065a37df7d63383913948cbc475669a6c5aaff6a20379d5bd89bbfa4c9510bff4e42597