Analysis
- user interaction
yes - max time kernel
202s - max time network
205s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 16:28
General
- Target BlackchatSetup.exe
- Size 45.2MB
- Sample260730-ty4ctacb68
- SHA256 6a82e83a536d060a92e0381b25cfe8d6b57ab14e923284890e5d813b83c74c86
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlackchatSetup.exe"C:\Users\Admin\AppData\Local\Temp\BlackchatSetup.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Blackout\Blackchat\Blackchat.exe"C:\Program Files (x86)\Blackout\Blackchat\Blackchat.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Desktop.dat
memory/2724-37-0x00000268C3D90000-0x00000268C4CE0000-memory.dmp
memory/2724-40-0x00000268C5EA0000-0x00000268C6BC0000-memory.dmp
memory/2724-52-0x00000268C7120000-0x00000268C72F0000-memory.dmp
memory/2724-48-0x00000268C6BC0000-0x00000268C6F40000-memory.dmp
memory/2724-90-0x00000268C5140000-0x00000268C5180000-memory.dmp
memory/2724-94-0x00000268C7BE0000-0x00000268C7D90000-memory.dmp
memory/2724-114-0x00000268C9DD0000-0x00000268CA040000-memory.dmp
memory/2724-122-0x00000260AE480000-0x00000260AE490000-memory.dmp
memory/2724-118-0x00000268CA040000-0x00000268CA100000-memory.dmp
memory/2724-110-0x00000268C99B0000-0x00000268C9A50000-memory.dmp
memory/2724-134-0x00000268CB770000-0x00000268CB790000-memory.dmp
memory/2724-130-0x00000268C9B30000-0x00000268C9B60000-memory.dmp
memory/2724-138-0x00000268CCF80000-0x00000268CCFA0000-memory.dmp
memory/2724-126-0x00000268C98E0000-0x00000268C9900000-memory.dmp
memory/2724-106-0x00000268C9870000-0x00000268C98A0000-memory.dmp
memory/2724-102-0x00000268C79A0000-0x00000268C7A20000-memory.dmp
memory/2724-86-0x00000268C50B0000-0x00000268C50C0000-memory.dmp
memory/2724-82-0x00000268C75E0000-0x00000268C76C0000-memory.dmp
memory/2724-78-0x00000268C2DE0000-0x00000268C2E30000-memory.dmp
memory/2724-72-0x00000268C2DC0000-0x00000268C2DE0000-memory.dmp
memory/2724-68-0x00000268C2D60000-0x00000268C2D80000-memory.dmp
memory/2724-64-0x00000268C2D40000-0x00000268C2D60000-memory.dmp
memory/2724-98-0x00000268C7860000-0x00000268C78A0000-memory.dmp
memory/2724-60-0x00000260AFD10000-0x00000260AFD30000-memory.dmp
memory/2724-44-0x00000260AFCD0000-0x00000260AFCF0000-memory.dmp
memory/2724-56-0x00000268C2C90000-0x00000268C2D00000-memory.dmp
memory/2724-142-0x00000268CD8A0000-0x00000268CD8C0000-memory.dmp
memory/2724-146-0x00000268CDE50000-0x00000268CDE90000-memory.dmp
memory/2724-150-0x00000268CDF60000-0x00000268CDFE0000-memory.dmp
memory/2724-154-0x00000268CDE90000-0x00000268CDEB0000-memory.dmp
memory/2724-162-0x00000268CE040000-0x00000268CE060000-memory.dmp
memory/2724-158-0x00000268CDFE0000-0x00000268CE010000-memory.dmp
memory/2724-166-0x00000268CE0E0000-0x00000268CE100000-memory.dmp
memory/2724-170-0x00000268CE120000-0x00000268CE140000-memory.dmp
memory/2724-174-0x00000268CE620000-0x00000268CE9A0000-memory.dmp
memory/2724-182-0x00000268CEAB0000-0x00000268CEB60000-memory.dmp
memory/2724-194-0x00000268CFCC0000-0x00000268D0430000-memory.dmp
memory/2724-190-0x00000268CEF50000-0x00000268CF200000-memory.dmp
memory/2724-186-0x00000268CBBE0000-0x00000268CBBF0000-memory.dmp
memory/2724-178-0x00000268CE210000-0x00000268CE270000-memory.dmp
memory/2724-198-0x00000268CE9A0000-0x00000268CE9E0000-memory.dmp
memory/2724-205-0x00000268CAD80000-0x00000268CAD90000-memory.dmp
memory/2724-210-0x00000268CCFC0000-0x00000268CD020000-memory.dmp
memory/2724-215-0x00000268CF330000-0x00000268CF460000-memory.dmp
memory/2724-219-0x00000268CB340000-0x00000268CB380000-memory.dmp
memory/2724-223-0x00000268CDD40000-0x00000268CDE10000-memory.dmp