blakcsee_stealer | 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9

Analysis

max time kernel
299s
max time network
315s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 06:34

Target
everything-software-windows-5.37.8.exe
Size 22KB
Sample260723-hbtpbasfpg
SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
MD5 41ad4cb04af8def70763d895973584e2
SHA1 24fd6c86360d98e565bc7f3a6aa8165bc34c325f
SHA512 db3e871cc646eeab7eb2bbeceb323f0951199ea698f91eaa5eec367e48b461748c472867383560c22bce5cba1d4f09fb25983a92f219c867e8fd40d0c53bb43e
SSDEEP 384:gMoZapK5vwxSYjWAlaWFOSxE1+aHRN7t0jHvDyR9zv:gnZaBgyEN+2t0rD+9z
TLSH
T1FFA27C9ADA78058BF8EA18B08279E98BBC3DB7D31B5092CB0354E6181D137C5FA3475D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Family: BlakcSeeStealer
BlakcSeeStealer is a Windows stealer written in C++.
stealer blakcsee_stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3756 set thread context of 4964	3756	everything-software-windows-5.37.8.exe	90

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4964	3756	everything-software-windows-5.37.8.exe	90
PID 3756 wrote to memory of 4964	3756	everything-software-windows-5.37.8.exe	90
PID 3756 wrote to memory of 4964	3756	everything-software-windows-5.37.8.exe	90
PID 3756 wrote to memory of 4964	3756	everything-software-windows-5.37.8.exe	90
PID 3756 wrote to memory of 4964	3756	everything-software-windows-5.37.8.exe	90
PID 3756 wrote to memory of 4964	3756	everything-software-windows-5.37.8.exe	90
PID 3756 wrote to memory of 4964	3756	everything-software-windows-5.37.8.exe	90
PID 3756 wrote to memory of 4964	3756	everything-software-windows-5.37.8.exe	90

C:\Users\Admin\AppData\Local\Temp\everything-software-windows-5.37.8.exe
"C:\Users\Admin\AppData\Local\Temp\everything-software-windows-5.37.8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:4964

memory/4964-0-0x0000000140000000-0x00000001400E1000-memory.dmp

Download