Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2025, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe
Resource
win10v2004-20250217-en
General
-
Target
8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe
-
Size
1.6MB
-
MD5
3fb336da68902df506fa6af15bcc028e
-
SHA1
fc183c73aae482328dfc0d82b239adf9624f207b
-
SHA256
8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1
-
SHA512
b0dfe41e95e5dab54393be4086e7a380fda36ef40ceebdc310bfd9804b0d45d912bb35abd4e844a0ff67b2ecc7647d51fbf56e29e6b67328f9f79c0f9584b4f0
-
SSDEEP
12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYit:h1zltpu0it
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 12 IoCs
resource yara_rule behavioral2/memory/4980-36-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-50-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-52-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-54-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-57-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-59-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-61-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-64-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-66-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-75-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-78-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4980-82-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation 8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe -
Executes dropped EXE 3 IoCs
pid Process 2676 jusched.exe 4980 jusched.exe 5068 jusched.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2676 set thread context of 4980 2676 jusched.exe 93 PID 2676 set thread context of 5068 2676 jusched.exe 94 -
resource yara_rule behavioral2/memory/4980-34-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-36-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-31-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/5068-37-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/5068-40-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/5068-44-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4980-50-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/5068-51-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4980-52-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-54-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-57-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-59-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-61-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-64-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-66-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-75-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-78-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4980-82-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4476 reg.exe 4760 reg.exe 2304 reg.exe 2788 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 4980 jusched.exe Token: SeCreateTokenPrivilege 4980 jusched.exe Token: SeAssignPrimaryTokenPrivilege 4980 jusched.exe Token: SeLockMemoryPrivilege 4980 jusched.exe Token: SeIncreaseQuotaPrivilege 4980 jusched.exe Token: SeMachineAccountPrivilege 4980 jusched.exe Token: SeTcbPrivilege 4980 jusched.exe Token: SeSecurityPrivilege 4980 jusched.exe Token: SeTakeOwnershipPrivilege 4980 jusched.exe Token: SeLoadDriverPrivilege 4980 jusched.exe Token: SeSystemProfilePrivilege 4980 jusched.exe Token: SeSystemtimePrivilege 4980 jusched.exe Token: SeProfSingleProcessPrivilege 4980 jusched.exe Token: SeIncBasePriorityPrivilege 4980 jusched.exe Token: SeCreatePagefilePrivilege 4980 jusched.exe Token: SeCreatePermanentPrivilege 4980 jusched.exe Token: SeBackupPrivilege 4980 jusched.exe Token: SeRestorePrivilege 4980 jusched.exe Token: SeShutdownPrivilege 4980 jusched.exe Token: SeDebugPrivilege 4980 jusched.exe Token: SeAuditPrivilege 4980 jusched.exe Token: SeSystemEnvironmentPrivilege 4980 jusched.exe Token: SeChangeNotifyPrivilege 4980 jusched.exe Token: SeRemoteShutdownPrivilege 4980 jusched.exe Token: SeUndockPrivilege 4980 jusched.exe Token: SeSyncAgentPrivilege 4980 jusched.exe Token: SeEnableDelegationPrivilege 4980 jusched.exe Token: SeManageVolumePrivilege 4980 jusched.exe Token: SeImpersonatePrivilege 4980 jusched.exe Token: SeCreateGlobalPrivilege 4980 jusched.exe Token: 31 4980 jusched.exe Token: 32 4980 jusched.exe Token: 33 4980 jusched.exe Token: 34 4980 jusched.exe Token: 35 4980 jusched.exe Token: SeDebugPrivilege 5068 jusched.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe 2676 jusched.exe 4980 jusched.exe 4980 jusched.exe 5068 jusched.exe 4980 jusched.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2956 wrote to memory of 1372 2956 8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe 87 PID 2956 wrote to memory of 1372 2956 8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe 87 PID 2956 wrote to memory of 1372 2956 8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe 87 PID 1372 wrote to memory of 4260 1372 cmd.exe 91 PID 1372 wrote to memory of 4260 1372 cmd.exe 91 PID 1372 wrote to memory of 4260 1372 cmd.exe 91 PID 2956 wrote to memory of 2676 2956 8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe 92 PID 2956 wrote to memory of 2676 2956 8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe 92 PID 2956 wrote to memory of 2676 2956 8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe 92 PID 2676 wrote to memory of 4980 2676 jusched.exe 93 PID 2676 wrote to memory of 4980 2676 jusched.exe 93 PID 2676 wrote to memory of 4980 2676 jusched.exe 93 PID 2676 wrote to memory of 4980 2676 jusched.exe 93 PID 2676 wrote to memory of 4980 2676 jusched.exe 93 PID 2676 wrote to memory of 4980 2676 jusched.exe 93 PID 2676 wrote to memory of 4980 2676 jusched.exe 93 PID 2676 wrote to memory of 4980 2676 jusched.exe 93 PID 2676 wrote to memory of 5068 2676 jusched.exe 94 PID 2676 wrote to memory of 5068 2676 jusched.exe 94 PID 2676 wrote to memory of 5068 2676 jusched.exe 94 PID 2676 wrote to memory of 5068 2676 jusched.exe 94 PID 2676 wrote to memory of 5068 2676 jusched.exe 94 PID 2676 wrote to memory of 5068 2676 jusched.exe 94 PID 2676 wrote to memory of 5068 2676 jusched.exe 94 PID 2676 wrote to memory of 5068 2676 jusched.exe 94 PID 4980 wrote to memory of 1196 4980 jusched.exe 95 PID 4980 wrote to memory of 1196 4980 jusched.exe 95 PID 4980 wrote to memory of 1196 4980 jusched.exe 95 PID 4980 wrote to memory of 1136 4980 jusched.exe 96 PID 4980 wrote to memory of 1136 4980 jusched.exe 96 PID 4980 wrote to memory of 1136 4980 jusched.exe 96 PID 4980 wrote to memory of 3264 4980 jusched.exe 98 PID 4980 wrote to memory of 3264 4980 jusched.exe 98 PID 4980 wrote to memory of 3264 4980 jusched.exe 98 PID 4980 wrote to memory of 3132 4980 jusched.exe 99 PID 4980 wrote to memory of 3132 4980 jusched.exe 99 PID 4980 wrote to memory of 3132 4980 jusched.exe 99 PID 1196 wrote to memory of 4476 1196 cmd.exe 103 PID 1196 wrote to memory of 4476 1196 cmd.exe 103 PID 1196 wrote to memory of 4476 1196 cmd.exe 103 PID 3132 wrote to memory of 4760 3132 cmd.exe 104 PID 3132 wrote to memory of 4760 3132 cmd.exe 104 PID 3132 wrote to memory of 4760 3132 cmd.exe 104 PID 1136 wrote to memory of 2304 1136 cmd.exe 105 PID 1136 wrote to memory of 2304 1136 cmd.exe 105 PID 1136 wrote to memory of 2304 1136 cmd.exe 105 PID 3264 wrote to memory of 2788 3264 cmd.exe 106 PID 3264 wrote to memory of 2788 3264 cmd.exe 106 PID 3264 wrote to memory of 2788 3264 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe"C:\Users\Admin\AppData\Local\Temp\8a5801a23b539960b1ba08d5fae2e17587fe6b9cf7b10092ad6649e29fdb50a1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nlkGB.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4260
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4476
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2304
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2788
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4760
-
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5068
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149B
MD5976ffa9a304b234c039c8739d97bb893
SHA1f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA2562b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA5121bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c
-
Filesize
1.6MB
MD5d8be76f1e1deec381fa77ab144ef83ac
SHA1f6cbc747d701838a7262cbf9636ef86f1f13d455
SHA2565a85973b5df3cd5d951883b977b1e03e4b910675ea03601b8b09a0fd09c106a0
SHA512862f5d73eeec38db88fe2307ccf0a9922dab6322b32891a9b4341e081f7d54807a0e21127412cc8f028539e59d293703853a1b4840850692bbce571507214a5e