Analysis
- max time kernel
298s - max time network
303s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
13/08/2026, 23:50
General
- Target everything-software-windows-9.79.7.exe
- Size 22KB
- Sample260813-3vsxca1bqd
- SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
Malware Config
Extracted
-
blakcsee_stealer
-
2.26.126.50
Signatures
- Family: BlakcSeeStealer
BlakcSeeStealer is a Windows stealer written in C++.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\everything-software-windows-9.79.7.exe"C:\Users\Admin\AppData\Local\Temp\everything-software-windows-9.79.7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3432-0-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-16-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-13-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-11-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-10-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-9-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-6-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-5-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-4-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-3-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-1-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-14-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-12-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-8-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-7-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-2-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-15-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-31-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-36-0x0000000140000000-0x00000001400E1000-memory.dmp
memory/3432-35-0x0000000140000000-0x00000001400E1000-memory.dmp