metasploit | f31670c2effefcbbd4dc8e36570a95779f0daf82c34d0a1ea50f9d7ebb4f4d8e

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26/03/2025, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe
Size

3.4MB
MD5

10380e1197e945a36525e36571c5e01b
SHA1

c6686e40287c91894dafd7880c8dd16c931d6ba9
SHA256

f31670c2effefcbbd4dc8e36570a95779f0daf82c34d0a1ea50f9d7ebb4f4d8e
SHA512

785c23284b9001779f39ee8b2f8272d6aa50684cfa01353a14565750dc6346fa97c0d800611238e4c13f33c22826be103bf8c2b7c3c7dc699c271626ff6a81cd
SSDEEP

98304:dxQeMDXMX/y5oVQeSIns6EckBQt8tBkrzVglqWQsECcnbtJK:YekS/ySIIs6pIQn+kWQs2btk

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Loads dropped DLL 3 IoCs

pid	Process
2940	2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe
2940	2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe
2940	2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2940	2540	2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe	30
PID 2540 wrote to memory of 2940	2540	2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe	30
PID 2540 wrote to memory of 2940	2540	2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe	30
PID 2540 wrote to memory of 2940	2540	2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe	30

C:\Users\Admin\AppData\Local\Temp\2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-03-26_10380e1197e945a36525e36571c5e01b_black-basta_luca-stealer.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI25402\1.exe.manifest

Filesize
1005B

MD5
fc3f1579f8456b61a1da5435bbfb14b9

SHA1
040e01daaf44784c60ba93ff86190e148f1f4b96

SHA256
4462e9e421d41437bb578e01c1519a7c6c25d0dff9a2e9b9f36b9fd1cdf50fbe

SHA512
bd7b9c74c4f914e1b59c160a75e3816c835cda6ffc96f5b6d4bda5583e84fb6576b8fefe90bab4450749ae7172a5b0c6ad862d4117c9ffa006052fbabd7fa389

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25402\python27.dll

Filesize
2.5MB

MD5
080e99cbea2f521fdf4e1c1fdd2e0e33

SHA1
0ef9a9abf1aaba455242c389925adce391a4cdb0

SHA256
dec7d6cf595bf68c5b7cc1447e8970b6b74cd9dabb29bd27648dd42a9de85e4c

SHA512
1c9e8f7e88a72c6b9225f8caca896a452d9c376d3a076fe00d1b3c321d9d1c5d20b644a91fe48b5ddc3a2e8e02f320c8ad9f7c6631ec3713ee65bd77c009f897

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25~1\_ctypes.pyd

Filesize
90KB

MD5
7896f2b2b44a6dc7f8021c142339ce07

SHA1
405319ed78e81800d54b1bfda6198d7af006220c

SHA256
da6f2a24ee007f2ba49b120f6253e2030563093b6abd4514bf81f7f2326ac96a

SHA512
7dc69fc771633f2e3864e5630fc3cd8cf01cb0abe24085fbffb4d91be705d5a4bd9e65032ac120fcb13eef489f825f3bf3fd5c447480fcea39ee1dfbeaeb7d5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25~1\_hashlib.pyd

Filesize
1.0MB

MD5
ae0ef46bc3a52a92544b6facab0f32a1

SHA1
4065dfd80c8725f08c9ad75303bc40702c14f6ec

SHA256
61372337fe96d67f92bcb44e6faeefb7fe404a326f819ea33e27d33db98226f5

SHA512
98bbdd3ae5c473d1b145e8e50b438541430ce623809b2c2284e8e6e819b20967472b7ddb2541b4ffd178ea63c333003b97fa1c9fb96cd0073a2dd492905c4d73

Download Submit
memory/2940-19-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2940-18-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download