blakcsee_stealer | 45880839303fe491b2676a37faaa1fe6192917b3e64de1d46858563f16518e2f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:27

Target
vsdbg.dll
Size 2.3MB
Sample260804-x6bvbaff95
SHA256 45880839303fe491b2676a37faaa1fe6192917b3e64de1d46858563f16518e2f
MD5 edf5eeed72c207be16d9119f87b6a70c
SHA1 4319a638252be2141e4878d709a60ac61168ccc2
SHA512 248b4e03640a9b70ed2d313b0dd1e3d59e96a895b51d57de1ccecb93628b8f6dd66835223de496f241a46efbdb245216cadcd94f961d5b7b933f7114bcec6d3b
SSDEEP 49152:BG4RmRcMlBRiFn8a8/S+pGUZRLoePOxDtlx14Svw+:csohpGUHPKDDUS
TLSH
T1FFB5DF29E3D912A8E567DA34CB626233D7B578160770E98F069DC2152F73ED0AB3B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Family: BlakcSeeStealer
BlakcSeeStealer is a Windows stealer written in C++.
stealer blakcsee_stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 5324	4336	rundll32.exe	89

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 5324	4336	rundll32.exe	89
PID 4336 wrote to memory of 5324	4336	rundll32.exe	89
PID 4336 wrote to memory of 5324	4336	rundll32.exe	89
PID 4336 wrote to memory of 5324	4336	rundll32.exe	89
PID 4336 wrote to memory of 5324	4336	rundll32.exe	89
PID 4336 wrote to memory of 5324	4336	rundll32.exe	89
PID 4336 wrote to memory of 5324	4336	rundll32.exe	89
PID 4336 wrote to memory of 5324	4336	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vsdbg.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:5324

memory/5324-0-0x0000000140000000-0x00000001400E1000-memory.dmp

Download