blackshades | 728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe
Size 460KB
Sample260930-nrgycathjd
SHA256 728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486
MD5 6cd50b5da53ca2ef02e3fd2e4f1cdcd5
SHA1 7dfc640f88203e795dacc21f3f7450844c27dfeb
SHA512 05102ceb037f3ca17e6c27c62c3f59df8ab5ef41cef9dd59af21cbb7d21ca41aa64cd1dd7e6a8248c3e2cd4395cef066f965418b4524dff235202382d3f22e69
SSDEEP 12288:IIotbA7AAXD0r0XL9H3O1qo7EKkgbCy6Cto:IIATAXgr0XBgqUZto
TLSH
T1EDA4238097F80934CD6D9276ECB71F147710C72A566696FF21819762BC1F234BAE3B09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery blackshades persistence rat

Malware Config

Signatures

Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades

Blackshades payload 1 IoCs

resource	yara_rule
behavioral2/memory/4572-5-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades

Executes dropped EXE 25 IoCs

pid	Process
4572	windows_u97.exe
2844	cKyTJ.exe
4624	windows_u97.exe
5544	SOCWN.exe
5396	windows_u97.exe
2260	YUJdT.exe
560	windows_u97.exe
3548	okZtk.exe
3700	windows_u97.exe
4108	sodxn.exe
4204	windows_u97.exe
5844	RNCWN.exe
4180	windows_u97.exe
4340	pzoJz.exe
1812	windows_u97.exe
3324	BiXrh.exe
5740	windows_u97.exe
4676	ZVKeU.exe
2528	windows_u97.exe
4868	dZNiY.exe
1612	windows_u97.exe
916	GBpKB.exe
5020	windows_u97.exe
5644	sncwn.exe
456	windows_u97.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sodxn.exe"	okZtk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\RNCWN.exe"	sodxn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\BiXrh.exe"	pzoJz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\ZVKeU.exe"	BiXrh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\dZNiY.exe"	ZVKeU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\cKyTJ.exe"	jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\SOCWN.exe"	cKyTJ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\YUJdT.exe"	SOCWN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\pzoJz.exe"	RNCWN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\GBpKB.exe"	dZNiY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sncwn.exe"	GBpKB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_u97.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\okZtk.exe"	YUJdT.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 4572	4908	jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe	90
PID 2844 set thread context of 4624	2844	cKyTJ.exe	93
PID 5544 set thread context of 5396	5544	SOCWN.exe	96
PID 2260 set thread context of 560	2260	YUJdT.exe	99
PID 3548 set thread context of 3700	3548	okZtk.exe	102
PID 4108 set thread context of 4204	4108	sodxn.exe	105
PID 5844 set thread context of 4180	5844	RNCWN.exe	108
PID 4340 set thread context of 1812	4340	pzoJz.exe	111
PID 3324 set thread context of 5740	3324	BiXrh.exe	114
PID 4676 set thread context of 2528	4676	ZVKeU.exe	117
PID 4868 set thread context of 1612	4868	dZNiY.exe	120
PID 916 set thread context of 5020	916	GBpKB.exe	123
PID 5644 set thread context of 456	5644	sncwn.exe	126

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sncwn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	okZtk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BiXrh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZVKeU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dZNiY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cKyTJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOCWN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YUJdT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sodxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RNCWN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pzoJz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GBpKB.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe
Token: SeDebugPrivilege	2844	cKyTJ.exe
Token: SeDebugPrivilege	5544	SOCWN.exe
Token: SeDebugPrivilege	2260	YUJdT.exe
Token: SeDebugPrivilege	3548	okZtk.exe
Token: SeDebugPrivilege	4108	sodxn.exe
Token: SeDebugPrivilege	5844	RNCWN.exe
Token: SeDebugPrivilege	4340	pzoJz.exe
Token: SeDebugPrivilege	3324	BiXrh.exe
Token: SeDebugPrivilege	4676	ZVKeU.exe
Token: SeDebugPrivilege	4868	dZNiY.exe
Token: SeDebugPrivilege	916	GBpKB.exe
Token: SeDebugPrivilege	5644	sncwn.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4572	4908	jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe	90
PID 4908 wrote to memory of 4572	4908	jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe	90
PID 4908 wrote to memory of 4572	4908	jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe	90
PID 4908 wrote to memory of 4572	4908	jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe	90
PID 2844 wrote to memory of 4624	2844	cKyTJ.exe	93
PID 2844 wrote to memory of 4624	2844	cKyTJ.exe	93
PID 2844 wrote to memory of 4624	2844	cKyTJ.exe	93
PID 2844 wrote to memory of 4624	2844	cKyTJ.exe	93
PID 5544 wrote to memory of 5396	5544	SOCWN.exe	96
PID 5544 wrote to memory of 5396	5544	SOCWN.exe	96
PID 5544 wrote to memory of 5396	5544	SOCWN.exe	96
PID 5544 wrote to memory of 5396	5544	SOCWN.exe	96
PID 2260 wrote to memory of 560	2260	YUJdT.exe	99
PID 2260 wrote to memory of 560	2260	YUJdT.exe	99
PID 2260 wrote to memory of 560	2260	YUJdT.exe	99
PID 2260 wrote to memory of 560	2260	YUJdT.exe	99
PID 3548 wrote to memory of 3700	3548	okZtk.exe	102
PID 3548 wrote to memory of 3700	3548	okZtk.exe	102
PID 3548 wrote to memory of 3700	3548	okZtk.exe	102
PID 3548 wrote to memory of 3700	3548	okZtk.exe	102
PID 4108 wrote to memory of 4204	4108	sodxn.exe	105
PID 4108 wrote to memory of 4204	4108	sodxn.exe	105
PID 4108 wrote to memory of 4204	4108	sodxn.exe	105
PID 4108 wrote to memory of 4204	4108	sodxn.exe	105
PID 5844 wrote to memory of 4180	5844	RNCWN.exe	108
PID 5844 wrote to memory of 4180	5844	RNCWN.exe	108
PID 5844 wrote to memory of 4180	5844	RNCWN.exe	108
PID 5844 wrote to memory of 4180	5844	RNCWN.exe	108
PID 4340 wrote to memory of 1812	4340	pzoJz.exe	111
PID 4340 wrote to memory of 1812	4340	pzoJz.exe	111
PID 4340 wrote to memory of 1812	4340	pzoJz.exe	111
PID 4340 wrote to memory of 1812	4340	pzoJz.exe	111
PID 3324 wrote to memory of 5740	3324	BiXrh.exe	114
PID 3324 wrote to memory of 5740	3324	BiXrh.exe	114
PID 3324 wrote to memory of 5740	3324	BiXrh.exe	114
PID 3324 wrote to memory of 5740	3324	BiXrh.exe	114
PID 4676 wrote to memory of 2528	4676	ZVKeU.exe	117
PID 4676 wrote to memory of 2528	4676	ZVKeU.exe	117
PID 4676 wrote to memory of 2528	4676	ZVKeU.exe	117
PID 4676 wrote to memory of 2528	4676	ZVKeU.exe	117
PID 4868 wrote to memory of 1612	4868	dZNiY.exe	120
PID 4868 wrote to memory of 1612	4868	dZNiY.exe	120
PID 4868 wrote to memory of 1612	4868	dZNiY.exe	120
PID 4868 wrote to memory of 1612	4868	dZNiY.exe	120
PID 916 wrote to memory of 5020	916	GBpKB.exe	123
PID 916 wrote to memory of 5020	916	GBpKB.exe	123
PID 916 wrote to memory of 5020	916	GBpKB.exe	123
PID 916 wrote to memory of 5020	916	GBpKB.exe	123
PID 5644 wrote to memory of 456	5644	sncwn.exe	126
PID 5644 wrote to memory of 456	5644	sncwn.exe	126
PID 5644 wrote to memory of 456	5644	sncwn.exe	126
PID 5644 wrote to memory of 456	5644	sncwn.exe	126

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:4572

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\cKyTJ.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\cKyTJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:4624

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SOCWN.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SOCWN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:5396

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\YUJdT.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\YUJdT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:560

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\okZtk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\okZtk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:3700

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sodxn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sodxn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:4204

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\RNCWN.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\RNCWN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:4180

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\pzoJz.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\pzoJz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:1812

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BiXrh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\BiXrh.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:5740

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZVKeU.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\ZVKeU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:2528

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\dZNiY.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\dZNiY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:1612

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GBpKB.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\GBpKB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:5020

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sncwn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sncwn.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
  2⤵
  - Executes dropped EXE
  PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windows_u97.exe

Path C:\Users\Admin\AppData\Local\Temp\windows_u97.exe
Size 34KB
SHA256 4d93d07c4d7a59f6489bdeec9ca6341a0f85ca242dffe0a0aba8248d542b0ada
MD5 b48e87b7fdbbb040fbb8081cb682fb18
SHA1 6e4ae25aa99ace61151092940cc1d1d575291011
SHA512 13ddd18edcacde12452a31c964b1deadb6ea8319365802ca9a39d392b18f68a4d9fad2a81d19d1d465814e13d069945ba2fb19ad26d0200280cacaeec4f06e78
SSDEEP 768:9ahgbp49YK+2Cza0pS6icHmMl9CvwOElkn3yKdnqRDvW:Nd4+KTMVJHmMsEBKdnqxv
TLSH
T1FCF25CA5DAD85022E5622A704AB0E471BF7FBB732535D51F9708D64C2CA23C2F96432F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cKyTJ.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\cKyTJ.exe
Size 460KB
SHA256 728c3baf23b7a7fa9564c9c59f0a22039ffabb5681120cd1af6c79d4dd0b8486
MD5 6cd50b5da53ca2ef02e3fd2e4f1cdcd5
SHA1 7dfc640f88203e795dacc21f3f7450844c27dfeb
SHA512 05102ceb037f3ca17e6c27c62c3f59df8ab5ef41cef9dd59af21cbb7d21ca41aa64cd1dd7e6a8248c3e2cd4395cef066f965418b4524dff235202382d3f22e69
SSDEEP 12288:IIotbA7AAXD0r0XL9H3O1qo7EKkgbCy6Cto:IIATAXgr0XBgqUZto
TLSH
T1EDA4238097F80934CD6D9276ECB71F147710C72A566696FF21819762BC1F234BAE3B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2260-43-0x0000000075080000-0x00000000756A1000-memory.dmp

Download

memory/2260-34-0x0000000075080000-0x00000000756A1000-memory.dmp

Download

memory/2844-20-0x0000000075080000-0x00000000756A1000-memory.dmp

Download

memory/2844-12-0x0000000075080000-0x00000000756A1000-memory.dmp

Download

memory/2844-17-0x0000000075080000-0x00000000756A1000-memory.dmp

Download

memory/4572-5-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/4908-0-0x0000000001180000-0x0000000001190000-memory.dmp

Download

memory/4908-1-0x0000000075082000-0x0000000075084000-memory.dmp

Download

memory/5544-22-0x0000000075080000-0x00000000756A1000-memory.dmp

Download

memory/5544-23-0x0000000075080000-0x00000000756A1000-memory.dmp

Download

memory/5544-32-0x0000000075080000-0x00000000756A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads