Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe
Resource
win10v2004-20250217-en
General
-
Target
2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe
-
Size
305KB
-
MD5
4227332b546488c03ab51bf00b145751
-
SHA1
2b37adfee87e7de962daddeed319c9cf7229216a
-
SHA256
ec00e3fe0c533f2ade7ff814d08ef6846e27754b9910f6dbb2e49d0174e829e4
-
SHA512
5173f38fda4cd9aad8a3d9827255114c0652f480ffccefb0f4efaf091fdfa9c8df7fddae2b4774462266a3bc9e45085b45616d906349b1ed0a93512988254b03
-
SSDEEP
6144:lHUhybzwjzkPmO6r7ib3tMbZ3suspx4xSOuJmeMHDhy:l0hUUjYV+ibekpx4OmeiDhy
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 12 IoCs
resource yara_rule behavioral1/memory/2064-11-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-13-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-19-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-21-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-23-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-24-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-25-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-27-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-29-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-32-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-35-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2064-37-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IUIX8R75CF.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IUIX8R75CF.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2316 set thread context of 2064 2316 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 30 -
resource yara_rule behavioral1/memory/2064-2-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-7-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-11-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-13-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-10-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-4-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-19-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-21-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-23-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-24-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-25-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-27-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-29-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-32-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-35-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2064-37-0x0000000000400000-0x0000000000473000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2748 reg.exe 2824 reg.exe 2620 reg.exe 2716 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeCreateTokenPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeAssignPrimaryTokenPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeLockMemoryPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeIncreaseQuotaPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeMachineAccountPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeTcbPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeSecurityPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeTakeOwnershipPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeLoadDriverPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeSystemProfilePrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeSystemtimePrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeProfSingleProcessPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeIncBasePriorityPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeCreatePagefilePrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeCreatePermanentPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeBackupPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeRestorePrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeShutdownPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeDebugPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeAuditPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeSystemEnvironmentPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeChangeNotifyPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeRemoteShutdownPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeUndockPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeSyncAgentPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeEnableDelegationPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeManageVolumePrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeImpersonatePrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: SeCreateGlobalPrivilege 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: 31 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: 32 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: 33 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: 34 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe Token: 35 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2064 2316 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 30 PID 2316 wrote to memory of 2064 2316 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 30 PID 2316 wrote to memory of 2064 2316 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 30 PID 2316 wrote to memory of 2064 2316 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 30 PID 2316 wrote to memory of 2064 2316 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 30 PID 2316 wrote to memory of 2064 2316 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 30 PID 2316 wrote to memory of 2064 2316 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 30 PID 2316 wrote to memory of 2064 2316 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 30 PID 2064 wrote to memory of 2736 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 31 PID 2064 wrote to memory of 2736 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 31 PID 2064 wrote to memory of 2736 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 31 PID 2064 wrote to memory of 2736 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 31 PID 2064 wrote to memory of 2704 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 32 PID 2064 wrote to memory of 2704 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 32 PID 2064 wrote to memory of 2704 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 32 PID 2064 wrote to memory of 2704 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 32 PID 2064 wrote to memory of 2148 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 33 PID 2064 wrote to memory of 2148 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 33 PID 2064 wrote to memory of 2148 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 33 PID 2064 wrote to memory of 2148 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 33 PID 2064 wrote to memory of 2712 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 34 PID 2064 wrote to memory of 2712 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 34 PID 2064 wrote to memory of 2712 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 34 PID 2064 wrote to memory of 2712 2064 2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe 34 PID 2704 wrote to memory of 2748 2704 cmd.exe 41 PID 2704 wrote to memory of 2748 2704 cmd.exe 41 PID 2704 wrote to memory of 2748 2704 cmd.exe 41 PID 2704 wrote to memory of 2748 2704 cmd.exe 41 PID 2712 wrote to memory of 2716 2712 cmd.exe 39 PID 2712 wrote to memory of 2716 2712 cmd.exe 39 PID 2712 wrote to memory of 2716 2712 cmd.exe 39 PID 2712 wrote to memory of 2716 2712 cmd.exe 39 PID 2736 wrote to memory of 2824 2736 cmd.exe 40 PID 2736 wrote to memory of 2824 2736 cmd.exe 40 PID 2736 wrote to memory of 2824 2736 cmd.exe 40 PID 2736 wrote to memory of 2824 2736 cmd.exe 40 PID 2148 wrote to memory of 2620 2148 cmd.exe 42 PID 2148 wrote to memory of 2620 2148 cmd.exe 42 PID 2148 wrote to memory of 2620 2148 cmd.exe 42 PID 2148 wrote to memory of 2620 2148 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2824
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2025-03-06_4227332b546488c03ab51bf00b145751_karagany_mafia.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2748
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2620
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IUIX8R75CF.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IUIX8R75CF.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IUIX8R75CF.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IUIX8R75CF.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2716
-
-
-