Resubmissions
28/03/2025, 22:50
250328-2r89gsvly8 1026/03/2025, 18:56
250326-xlfmrssqz9 1026/03/2025, 18:17
250326-wxdf4szyc1 10Analysis
-
max time kernel
104s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
26/03/2025, 18:17
General
-
Target
2025-03-26_17cc347c7c544e98a18dacf02a25d619_black-basta_cobalt-strike_satacom.exe
-
Size
502KB
-
MD5
17cc347c7c544e98a18dacf02a25d619
-
SHA1
263aa440a706fe3aa909fd8b212185340e7ede94
-
SHA256
30a4d2ae21ec90ebdd415b90d2fe670ac5c0ffe54d0d8f7a01a54910ba1a8c45
-
SHA512
e686ac882f4fdbe0efb0833186640d61d75b3132d026e5f2e1da35a01efca371e63cea3953a33dfb29ce130e6b3e0103bfbda099fc3da092364cc43427e15aeb
-
SSDEEP
6144:eo2mNDxqElXchsLP3JRBNGJLEAxSKfC5ogn3WJGBV50DErWuuzgXmPdt:eo2BYd73FWLExKfcoaWJtDTv
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (137) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-26_17cc347c7c544e98a18dacf02a25d619_black-basta_cobalt-strike_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-26_17cc347c7c544e98a18dacf02a25d619_black-basta_cobalt-strike_satacom.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD553c70b3581eba0d847eac076245f5a1b
SHA16df91bdfc0892bd20c0705cdffca79c43a78e486
SHA25692530138eb7a2975d5c1cbdaacabc6c0ad273bc00233e08f8a6345f7ca630a70
SHA512265886ed02dd58c6ab9e33b8ee651b8d14879738fd8e2675e52b9fc927c3028b72113154d6a003049f18989370c9142a3c31cb66d8555c8d3172f3402e82b94f
-
Filesize
15KB
MD5695f4a689951b97d0550078c4508fdf5
SHA1d2460073a038215799616729ad5ec69bbd60d9ff
SHA256a695bf8683e226dd96edcb54b68dcc58b9f4160c5c246de96b451048788ab693
SHA5128b1cb12dda3c2fe2281c7af8561d421f5c80d734e517ab5b7e78ce23c8849398fa8e012ef652b055ee4c0c1adf9b511150a42751649b193dd028f2b38d5b74ad
-
Filesize
120KB
MD548a338f46ece00b25868b18a7d6a13cf
SHA1aff9fbe92c886d64907e73cbc7d5e9433c7ae7e1
SHA2568a064173a77d3172431b5101d754ae61194805905a0e81bd0c9165c3e3336eb1
SHA51237352234d1a31be6fe1f078a6ebdad3ddbb5618a43f87211b509ad0947c53a6b8aaae5770e2359aa7fb125953db6a91a1379deab62d87d88ef668a57fd1540b4
-
Filesize
113KB
MD5bffd101e5c7b6c0924939a8beef63022
SHA18c1811caffb3ad58a6e1028e260b5c7e603f5a0d
SHA256c6133483e8cff1647f40fc314ddb9edb47a28a084a34d1303f78ffc14efe098d
SHA512f331688a23feaa266adc93334dbaa025beb11e06ab9ae170ef8609a71406b180a8c6d004b900434b1f2d2c094a7caad986ccbbce16bef64e3fb64647ff37fe27
-
Filesize
135KB
MD59fa5bf34e82b3f939bd708f86bd5da24
SHA16afa9c9941619a7ae9cb0ab78ae72a70eed85076
SHA2563e7cfa8cd03e659d453dfd695e11592fcc7b5eb7134d653bb6ed45901387db34
SHA51206ae2afc58fc65f83b4fa2ff3104cd96b233fcd0a596a0c9538d6e419a36ddb6b3f76d0636c716a612150fbf4b96fa853f48835c12e223a74f027c953dda638e
-
Filesize
215KB
MD5b26d31a0322275e681ef5686079f4923
SHA17013bfb645dd17b9763c1787b3bc8fc85bd293ca
SHA256e88925880a4169241cfcb4cec5fb0637fb675fa8badb6cabba15a29347908518
SHA5127c0015185f775fa7b5cb07979ac8bd03fd9c19e2bd9e214dd22aa0919a75a4df3b0ba7a5d6980a832b78995633343601f117559c0fb83d070abc02f636bdbe54
-
Filesize
252KB
MD5e3171d1d78513af9a4d3d51704d0a06d
SHA11e1d2930727e67f8e79070369b4b768c4518cf52
SHA25686d58b49b596f91d0ae9d15d376df25c075e00668324530c38b679b1c47b2694
SHA512356c5dece13f9a831a66153b618dbc2768d8a329991b45183ec244a34577ffafe95b670623963f3a1bed95fbda17335c0671edeb9bc9f4f87a9f86de36abb842
-
Filesize
179KB
MD5cf2f64729138a31384873d007b9fe2f2
SHA163cd4f8e34d6c5c77842d8d10196e48d6693a818
SHA256e5ce7bbcd96407f05c8b165689a202020b6ab793a31fb497221e2e8c030f0efc
SHA51203ce9de389fbb826a0817381f458991c83ce932c9747faac4d2958a28bdf101e7f75596da4940882068eb9cb7ae6b8c0b171511b52d63050d51aac95c6a97f99
-
Filesize
106KB
MD5e824629fb789210271c532333610119a
SHA10d1392946a9d3cbac58446c4db9c27283709660d
SHA2561f953d88ce24ad6f605e8fa5b45b828215e5b3f9dd53874e9112cb78011649b2
SHA51240cd951e290af4774e122b629baab36bc8c54a7dfc6e75123b2eef804fbca4e915928912a2523a0faf46881bebe8df21fba034acaed78b4fd2c80fb040842a50
-
Filesize
201KB
MD556e98140a852b165afd060db60ee908a
SHA11fc5d7f58471f920bfed0c2c6416f8cf56a36212
SHA2565081ab180a152b2942b6f661c9de8ed00100d4e0a3a21ebb3144e2ed2df6537c
SHA51202ff4d3801636fe30121290e9880b155d5976c39e7eea7224b2c7bdfeddbcdb003d3e5c864f6891c3caa35dfb798787d2b4f6ae433b7579e57df9119276a65af
-
Filesize
230KB
MD51cf12e87fc14ad0a26d6dfba82bdd1f1
SHA1e443c32e90d521cd627d48da6933e253c41ba230
SHA2567e2e6af8bd6f921893c80579e044e71ec7bd680f0f0bc6dbf258d6a2ca78ca61
SHA512bfc829bd8f4b745472cfcac552d20f4e9db925d7755b935792120b36f92ac74aa100329f44f2a573a245eb0a20875ac916c6b593916d8ccfd566242b8ea8485c
-
Filesize
157KB
MD5a04337d24557fabea3e0445330257366
SHA161203eb46f709e107705fd4633fadda04b1463c4
SHA25662f4eabdfdbe49dc204c0dde221a2fc30dabad3401f66c1a5caf7155b861c0f0
SHA5123dcab7383f1ded46860544018f3ffd4b018a08c8b39d199bdc62416da4d9f2f57be1bae9452eaa91f1e6599e712050e9c5fae8f3c642f871fdff289a96170671
-
Filesize
416KB
MD543cdf977d82a042b1180c1fb7f8f65f3
SHA152d8e32cd78e2c77e02be27f729cf972782ab3ea
SHA256c27e22947f50badaf76ec874874614a6a6f93f87866f4f0718fc99b3dcf91cb7
SHA5128f36b9d3b823dd85448676e962694755ae82af3d8705ac11cf532b84b7c08f1ee391d21cb2069d931e63812b4b5e335355948b29086c0c9e3de1061331402e52
-
Filesize
237KB
MD510b4324856f1d658f02879450a55611c
SHA1542163dc7e80ff096bb3ccf4643b96cd92419fc4
SHA256c9b9ce46dc7b6c419245709dbd309edb37c8f828f3ecf3f578c97241e9bb2731
SHA5125fd543d9c17afc1417507b61a665570f079d6a37cb0aa95f85587fa8e6400756a47b635a7af6eae32cca71bacf91cc669276786fc7e5415b5a04f8fb4bc52533
-
Filesize
16KB
MD5a1a92e2891c2954a81b8dd14c0a3cf00
SHA157c4dec94f0d6b9e42b488613e606149aac499d1
SHA2568d60a841ade68247a19cbf59bd8cdf862db2cbc2e1ee18b48899b01284af0041
SHA51209f1eb91f27938b16b5944a534213868c907176ddbbac8bf2946e91c9ea35d8c3411a637639a4fac6a3e17ee74a8b6c27b06f3d8aa61777cd5f83472cf73781d
-
Filesize
128KB
MD5fc9fcd0671ac7e691c1eba197450f33c
SHA136319bacddd5d8612ede8328f43841282edc56be
SHA25676c1cf5f18b2abf581f2e7cb5a416cb3dbe4b4de206cc0e927ba1d1ca0cd5d36
SHA51261da6b823e59202f32fbf594eea2bc009e3055871cfde07a7737705c8d232772c0285790007be22fd59715e506f8156419decfbecc4b99046db64ab7a2ef1dbe
-
Filesize
164KB
MD5e0c30f6a4fa01df8d6c3643bdd9f37ea
SHA1709bc2981ca33d9021a34056f50e4f8ffd682a57
SHA2568ca1954f3de097851d1452fa03fc5d8ef773ddfb7929507d8111e636b62576ff
SHA5124d95d540658bcc22266764db235630eccbe08314602bdd9a2fa2633c3a671bea5c94ee1891ef059e76d1f080e4f7ef4a29baf46d4faad3f68a14d1d3219cabb2
-
Filesize
274KB
MD5b040ba00ae103047062523bd4775dd96
SHA18113f1320852890d415257b55d00b5be208c6f21
SHA25674ac263da7b3d55cc51c7c9ecad8bd041d2f9d0d1520d2322af52ff59edb5786
SHA51277c191eb3c26c557910fcda9b6b5e98ad95ea8b8c37ab60eefc504071a473cf9363bdc5ff5bf3e25f51b4d82bb3df3d3155925cb7bce801fd14ee3005653d9ad
-
Filesize
303KB
MD5db24a045f69ab49187e2ac5b6f9466f4
SHA17ace8b0194637f6e5320d9c58a90fd6fee524b02
SHA2562252c040bb43ad52c4f60ab40daa13025dc3ac64c700d45b52a622227c11d938
SHA512c9c8d204fefebec569a11c8d9d7ec376d1a4b9e2be7d65d4eaf41ea1c421c4a68e341560167b633932b894d7168a18383d576fa84147f1a8cbd4e9a5325d92fc
-
Filesize
150KB
MD58ac7902011a46f7852b53dc4c3643915
SHA1e0ed68b7a675c66ba05da9913a55a06263853e02
SHA25690b01cab0e07e5f335aab4e5f9cb0b3a481cccbb5b3d7a3e7decc28fdd7be0a2
SHA512506d154234023f7c461828417cf6cf47cbcf56fdbfb714e1c74a6a91508b7639f2de224739938d9351e4b52cc7b41871319454c55a75a96d1eb7216c2d09a1d5
-
Filesize
208KB
MD535ff92b77efe46a5c13cc1375c276738
SHA1d9b360e3c7cb1fe1c8f2c27767ff276160a32177
SHA2567f8eef5c3926ae103269a232814519bfeb28d35ca1a0fa29257855f250a34773
SHA512f4b4d6cff932f6855ee04d6227e1d694b835aef4634bf27c60dbb61be89dd49526521a535131da6eff13f44f53493940c3676ade5ef2b53b1b40cbbc1425fd19
-
Filesize
288KB
MD5286df79e4b5b7187a01d99fff8a283fe
SHA15dd961b56f5337b8a6d4766d412e3caae35ab287
SHA256b71e3e2a0b2b6f46eabcaebf9a9b0616c95b84cbe3636168651f5e7542ace061
SHA512aaa45c04afd525ce7d2af957a0018f4eda19faa6145c867308d0a199bb9f8ba5d3aafbadbac13079204037d2dea95068c647b7d9664b6c158ce0f113d06af9e3
-
Filesize
259KB
MD5c033e7fceb15b05fe6d3694b20627fdc
SHA195f4d363a51c6c91fecd8533d06b5e475a707901
SHA256a1274a104c14f3509187f70f4f9d1e7af8c49bbc3bc4164cae685268e26af731
SHA51282f9cdc11ad0a3c0d9c194d191c13d015e8d5d4969b39daa185b2d837990d71b9e12a642bad7d990b916d52ea24ff5009f82be38ec437d22d219cc3488517a46
-
Filesize
142KB
MD5bd7cdfaf67598293781ecea327fbce8b
SHA176e729610e4a80f16f363115d6b279b69131f7bb
SHA2564816525f2d4cee168d957a0864b4a516daba0b216dc885339ddd098a5512175d
SHA512f84f8a951711593160a098e45c03d187b1b23d0c7563a6589c9772a63c719a0258f381d5d32f823fdaf8341ffeab5b086196bec754d91551936ca58a17f29a7c
-
Filesize
171KB
MD5541099eccad4c183227083dc3b58cffc
SHA10237419fbdc82b5fc07bb3aef39be0a8fd5fb1fc
SHA256f1d9cac9cf7c6158ddfd9d816b063e1665e6e934c66f653f2bd5b7e065eb1723
SHA512d66a739093ea736657087323012ea11083a5527dd0b53b2faf254309d7b84a138916e38d6f7484c219a14ed3d321145134ea557ab9a86dd349d8812553cb33e3
-
Filesize
266KB
MD57e683824bbb91cb0f4bdece79a730424
SHA160bef50d3de12ed41d6f309f9064941843ff291f
SHA256f332c0fad10f7d57695d22ed1954766144514d91c6d333d42aa145cfeea05ebe
SHA512fef251599075daec4f481d89d40cbc6868b7a5a4c7d2981c16a20d73f03c2aac3bb3f271d492f93150843a8cae79a78e0d447cd183e18ae07a607a540aed7078
