blakcsee_stealer | b41017f98f93938550a6655981a500ca5a5a97ea9503e3de89948f8d3cab057b

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 01:58

Target
atom.dll
Size 7.5MB
Sample260816-cd3gcaag23
SHA256 b41017f98f93938550a6655981a500ca5a5a97ea9503e3de89948f8d3cab057b
MD5 16165d3d6ccfd3404b2fd36dbb4cfa81
SHA1 f032e1b825b176def5a5ee56a0fc5579b5d17896
SHA512 944569581d262f351fd2a62311edae814ccf6ba24a33c714f4d2dd273c737a48dad6fc29a26db2d892bba8f9620e2a972ca5ae067509e24745233d38119078df
SSDEEP 196608:URobyBfr2lJOVqKXWcF5t2Q8X3ZYFTSRzOeYT9UMeN/I5us:URobyBfrLgU3KFnZE86eYTOMepx
TLSH
T1B086BE55A3C45AE9D416DA38CB14E332C2B2BD624A76C08B499AF70A1F77E514F3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: BlakcSeeStealer
BlakcSeeStealer is a Windows stealer written in C++.
stealer blakcsee_stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 5844	1420	rundll32.exe	89

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 5844	1420	rundll32.exe	89
PID 1420 wrote to memory of 5844	1420	rundll32.exe	89
PID 1420 wrote to memory of 5844	1420	rundll32.exe	89
PID 1420 wrote to memory of 5844	1420	rundll32.exe	89
PID 1420 wrote to memory of 5844	1420	rundll32.exe	89
PID 1420 wrote to memory of 5844	1420	rundll32.exe	89
PID 1420 wrote to memory of 5844	1420	rundll32.exe	89
PID 1420 wrote to memory of 5844	1420	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\atom.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:5844

memory/5844-0-0x0000000140000000-0x00000001400DA000-memory.dmp

Download