Overview

overview

10

Static

static

3

2025-03-27...om.exe

windows7-x64

7

2025-03-27...om.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    103s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2025, 01:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-27_0dd22f3fee3c889393ff193c12caacfa_black-basta_cobalt-strike_satacom.exe

  • Size

    23.3MB

  • MD5

    0dd22f3fee3c889393ff193c12caacfa

  • SHA1

    9f34b7d1486a1993204ee4eeabccda8ca3162c1e

  • SHA256

    43eb1369808b406a2a0a2ebc17ad86da61f9c4749dbe2df467ffb99939b133a0

  • SHA512

    83d6ca09ec051dee96413384f8b60b6cdb81a3c48deea2dc4b92f08ab5d00374dc2cf7e9fb2f6d1bde1f7db3c05d84951c6aff080af0d9aa021488a43da423a2

  • SSDEEP

    393216:jUlCmhQGCEDo2WtYjUaNRDHvcrwhvr+bUn2KekLTP/WViHdZk6tN3ZWPTvE9Hhwq:YjtCEDVfjrRj0r6+bUno0dZk6tN3OUwq

Score
10/10
demonwareransomware

Malware Config

Signatures

  • DemonWare

    Ransomware first seen in mid-2020.

    ransomwaredemonware
  • Demonware family
    demonware
  • Loads dropped DLL 34 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-27_0dd22f3fee3c889393ff193c12caacfa_black-basta_cobalt-strike_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-27_0dd22f3fee3c889393ff193c12caacfa_black-basta_cobalt-strike_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\AppData\Local\Temp\2025-03-27_0dd22f3fee3c889393ff193c12caacfa_black-basta_cobalt-strike_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-03-27_0dd22f3fee3c889393ff193c12caacfa_black-basta_cobalt-strike_satacom.exe"
      2⤵
      • Loads dropped DLL
      PID:5684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Cipher\_Salsa20.pyd
    Filesize

    13KB

    MD5

    86109d2d1fccdb91968b7c1a63823731

    SHA1

    89dec67fbb4e467604f20c53c3ae3949471aef58

    SHA256

    28efd36be6bbbc56a7219bed7cc132ce67baf629100cc03a08a804360f483db9

    SHA512

    5d331f7f3ca413e77c33fa57e1f07ef43d064545ff1d143b9086211b42bbe165564c62b07d7a44615e75221613f3d3127ef5d7c7ec06315f0c397c0b059d2a37

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Cipher\_raw_aes.pyd
    Filesize

    35KB

    MD5

    e6c16a8f39eb63ee3c75c3498bccb35d

    SHA1

    b28cfdab4f11b1ad1ffe52847b275fb3b356fe2a

    SHA256

    6e1ae3d0bae24c9641d96719eb4e941a6ed17c1e1b90d8b7478d6f7cbf9c4d9f

    SHA512

    daa2ff6e68fbe8062e46433fdd32382ce88dadcac400a6882961828583e73bbfbea1bca80690b13ba650e9e899b7ef41a86faafccf1719868cdbfdbc07623820

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Cipher\_raw_cbc.pyd
    Filesize

    12KB

    MD5

    ff9b1e03922361e0a8be65e5e1421aac

    SHA1

    d4d674fb4e0214903e341e98613328d51aff9054

    SHA256

    2a5ab7f23554f497693ca81a5e5f21647b10fd8b9e00b8377d8385dc15a9c4df

    SHA512

    8cbbbbdc9a3d9e866dc88a655a75317f58cb4a49cb262975ff8c4ae5d47c344b86f69f6d2fc369dd7aa8ad7fcaa40d1937320e7e4f5923a03a39459b7bb247c0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Cipher\_raw_cfb.pyd
    Filesize

    13KB

    MD5

    06358818f111a1c8e1b76d60a650c997

    SHA1

    5bbaf40aeb932766346631df25d887264aad7ac2

    SHA256

    b5438682a4c6bf57dcaad2835a9a293f712284fbe1af4ba6059011396cdbd180

    SHA512

    f954b4e56e3ace2c8e0961149cb5bd433f35530bc1c5e38ec5d2223ec3591df0998903b3928668c5d8c05f16eaa1c2adf41fc999690c42dafa794800fc4b193e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Cipher\_raw_ctr.pyd
    Filesize

    14KB

    MD5

    6adf70fd22d5ca90269466e5fc2aca2b

    SHA1

    1d4cdf2b08154b33738c5244a8886284c71693b9

    SHA256

    2f9dfa9de351bfe553dde60ae891e9b54a2e08546d723c7165234fd41c3ceed4

    SHA512

    efbd7133e5b5ef035f5a09d92b3b12d3ad367d6c35856a842536102d36a1ef53afe62ea3c3a5a4ae641bb28b6caaed18afa3519a637aa36f71f71979d4f61239

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Cipher\_raw_ecb.pyd
    Filesize

    10KB

    MD5

    64f6350fc1145db6337a9e3dfb83222f

    SHA1

    fea799c3f2a655d5104a46b788d98ea272557ae5

    SHA256

    821a86630238beaf4e303196ce26a250ef873f7a98b92644566b3c7d683d400e

    SHA512

    58f90099630b98a632db38d7cc4a2f44c70bb012f55b3b5a69dffc3a76f6a2b30ab81d678b95e807c135b96633a0d8ed83428924a1c9d1dfdb7f2a3962a44d31

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Cipher\_raw_ocb.pyd
    Filesize

    17KB

    MD5

    9cf1780e69e1bf2df2487b4de72806e5

    SHA1

    0955d77afb6a8e786dcbbf4f0b5b221bc302c6c8

    SHA256

    59cf35c376f312b1c6a5844f0740fcae4caaa5a3d3cd0e953959b5f4190a475d

    SHA512

    b1c4e6841c739fccc86e95da53ae10c3efa18f3a747b8e92883e7224cbe4f44016102fb6f713aa4345ba37dbf7c07d5517dfe9d564e2d4d120d154fd7de717f9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Cipher\_raw_ofb.pyd
    Filesize

    12KB

    MD5

    670c2baf75e559b89435283298f75bef

    SHA1

    be1e5a0711c6c0bb1e2aef4ed18a15ed5759b027

    SHA256

    236650fc42b347b9caa5e3a84a13da9e40586d97762f87730c9016dcb81abf06

    SHA512

    52554fe5308f7b758b66b48262aae1c180191358e15fdd85b7d5ef47a35677e079c3ef6a54e63d1520038bbfc79bad5b2534b1c2808217ffb53c55b7e8862fdb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Hash\_BLAKE2s.pyd
    Filesize

    13KB

    MD5

    9098b9c8340047c6434825e18826cc18

    SHA1

    85dde191f6549aca0813d8a723d39b83c61002db

    SHA256

    825039711c334e169432a482f8b71ae735d7a1bd56552e501f6f3eca87cf272e

    SHA512

    defc6852291b568793a48124184342272f4bc424f88de82a35335d5596dfacc93a52afc33c43337e4ceb800c5bd998493a7ba7f52c02a6027a4434d7e608fcae

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Hash\_MD5.pyd
    Filesize

    15KB

    MD5

    2f4c07b5fc3c6245b0e1269c0d1a5a97

    SHA1

    26ea9baabadf63e5a44f3b606139f249bd120b99

    SHA256

    efb961372f6ce102a9836b63038ae1385b408ef8dcf2de7238b2403a6e987b27

    SHA512

    21e1ccbf238fd59c1ce80543a8f21858ae6e15ad1e8536a0144ec06791cd2488822ae87d84e331e9135142c76506e68fad7dbb4b26428ff3ac0d43f49e8fcc92

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Hash\_SHA1.pyd
    Filesize

    17KB

    MD5

    d2ef20fe88c483dc2588c03876058afd

    SHA1

    86a7a9e71df94fec73dd90a9a4cf5b7901ce622d

    SHA256

    6cc9cfa3c9739b545808e814a661b5b54e9127b057ce503024e515648b7a4a33

    SHA512

    d1ea9f01ea1a16b23b6219492b3d2a27b017ea8d5511549c82fe3a58da988b890e52d144630c55fd845b8d079c4b6d3fd2172020cecc5f6dd6a05b1495d18c71

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Hash\_SHA256.pyd
    Filesize

    21KB

    MD5

    363b8e9f9a119ee0a52d8e75083f3f5d

    SHA1

    e0f4316f5afd2abc31047b50fdd7910d148a7611

    SHA256

    1b36afc5b2f6f46d1a2457d56f276f5b5ffed066955acec911b9b7973d1e92b3

    SHA512

    3862436b88dae084993772d6ebdd3c7a892a562045ce448bc6419c7c21c797c806ef6030157c8daf2e85a36b13ed0ce4475eb00e61ee0cbec4db2677e780f177

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Hash\_ghash_clmul.pyd
    Filesize

    12KB

    MD5

    6ffdcbb8b3860fab46a4666c97f17eaf

    SHA1

    87defb8a639e0af86b6943490eb5456d6d63183e

    SHA256

    2ea2b17aaac9e572eef1239b01e8ad378829b765958fd1bf306f39983a76f944

    SHA512

    769941e8aac1075415f27c272510eda7c6156a0f29f0a19523251367946340ef53315771e6985c91ff4314ba1fcb939b1d5cd197dcbdaaed272733c9875e9b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Hash\_ghash_portable.pyd
    Filesize

    13KB

    MD5

    35025bbdbea7932bbe4e79627250dc46

    SHA1

    4082c2aba70d98fcf6ec2b82ff4cc6692d7b56ac

    SHA256

    800cc846930302519335afdd276f9cbbe5f940fe1e5035cb6baf4fb736d37434

    SHA512

    a65e3c17e2ef456258eec06e81fcfa9af97a0d13b05eaca96935e371aa5e768eba9fa2e00f6cb5930d25d57380654cd2b8c8cb680a686c912e5f36a3046e0db9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Protocol\_scrypt.pyd
    Filesize

    12KB

    MD5

    dcd7e1c1f1e68405d66cef954cbaee38

    SHA1

    bbe8c8bde0e1956f4d88d737d50b2215073cdcb1

    SHA256

    0ec713f4f3e963f618873ff538c7dcc532e0faba5025c5a8e20ac089fdfcf1d4

    SHA512

    10d2048ff68515862b95e658bb33e42ed0fd2ab70db66f2738487d21739172d4f24ffb8f239fdfc6f479ce582a85c3b8f8adfb5024dad5769713a4b3d22d3115

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Util\_cpuid_c.pyd
    Filesize

    10KB

    MD5

    f35a4c3bb2fb8782c1c3f0d6b493ce77

    SHA1

    688c8baa950cfd77fdded246976829cc7510fce9

    SHA256

    a6feba74067fb03ee4ba53d1608ab8012eb6bd1f995ebc42c21d653d57b8320b

    SHA512

    5cb5219dd33ac40bd901298f17945fad21b25b0358056d10c84440048cf845bbb7acd0f6501d4284508b7559eae04074b03d13f6a1e4069df011895dfd3ceac9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\Crypto\Util\_strxor.pyd
    Filesize

    10KB

    MD5

    db1f79a96a1390028df325dd183ff9f1

    SHA1

    8373b6c44fdbece2c1ee5327a2bb5e5b0a719ed4

    SHA256

    6429928799a5eea9e090224a2d7083b469892d725a28ea9dcc2a95f94286b0da

    SHA512

    dad71f250340e529883e3347e90e66a445641f019351e745940c6700145c6c923a9d5575efaf42436823bd8f1db44e9b00c99eb1cc41dc49425ea9db9847590e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\PIL\_imaging.cp39-win_amd64.pyd
    Filesize

    3.0MB

    MD5

    7bdda60c9136dfcef785132a0c77b193

    SHA1

    f6bcd152d638cf54767203edb238eef2993b98bd

    SHA256

    bec23da5408f0fff9fe31c0ba49f6cd305ab6e242c270305c904295e54e88266

    SHA512

    b2e3df1aefdf271e494c91a9fa19bf0dbf8696fe30e524827659198080467dc5dc5d4a2394f27cefd8bb9923ece8757ccedaae3b5f836d4175690f128032098d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\VCRUNTIME140.dll
    Filesize

    93KB

    MD5

    4a365ffdbde27954e768358f4a4ce82e

    SHA1

    a1b31102eee1d2a4ed1290da2038b7b9f6a104a3

    SHA256

    6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c

    SHA512

    54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\_bz2.pyd
    Filesize

    84KB

    MD5

    e91b4f8e1592da26bacaceb542a220a8

    SHA1

    5459d4c2147fa6db75211c3ec6166b869738bd38

    SHA256

    20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f

    SHA512

    cb797fa758c65358e5b0fef739181f6b39e0629758a6f8d5c4bd7dc6422001769a19df0c746724fb2567a58708b18bbd098327bfbdf3378426049b113eb848e9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\_ctypes.pyd
    Filesize

    124KB

    MD5

    6fe3827e6704443e588c2701568b5f89

    SHA1

    ac9325fd29dead82ccd30be3ee7ee91c3aaeb967

    SHA256

    73acf2e0e28040cd696255abd53caaa811470b17a07c7b4d5a94f346b7474391

    SHA512

    be2502c006a615df30e61bea138bd1afca30640f39522d18db94df293c71df0a86c88df5fd5d8407daf1ccea6fac012d086212a3b80b8c32ede33b937881533a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\_hashlib.pyd
    Filesize

    64KB

    MD5

    7c69cb3cb3182a97e3e9a30d2241ebed

    SHA1

    1b8754ff57a14c32bcadc330d4880382c7fffc93

    SHA256

    12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20

    SHA512

    96dbabbc6b98d473cbe06dcd296f6c6004c485e57ac5ba10560a377393875192b22df8a7103fe4a22795b8d81b8b0ae14ce7646262f87cb609b9e2590a93169e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\_lzma.pyd
    Filesize

    159KB

    MD5

    493c33ddf375b394b648c4283b326481

    SHA1

    59c87ee582ba550f064429cb26ad79622c594f08

    SHA256

    6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16

    SHA512

    a4a83f04c7fc321796ce6a932d572dca1ad6ecefd31002320aeaa2453701ed49ef9f0d9ba91c969737565a6512b94fbb0311aee53d355345a03e98f43e6f98b2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\_socket.pyd
    Filesize

    78KB

    MD5

    fd1cfe0f0023c5780247f11d8d2802c9

    SHA1

    5b29a3b4c6edb6fa176077e1f1432e3b0178f2bc

    SHA256

    258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6

    SHA512

    b304a2e56829a557ec401c6fdda78d6d05b7495a610c1ed793d6b25fc5af891cb2a1581addb27ab5e2a6cb0be24d9678f67b97828015161bc875df9b7b5055ae

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\_tkinter.pyd
    Filesize

    63KB

    MD5

    0b6ec42276cbbf7aafcde5b0f72211f4

    SHA1

    2f9d09ab988a269c44df080224851dd880371d78

    SHA256

    ac4262aaa4689a0e08f6f03af3928491d023c8b65fcfbf6a030dd884f3900150

    SHA512

    265317961130c9cbee5ee6982d21446bc3ed3fd2a57bd6f60909e082c39f26b44b8a974430b4f841cdfaba4217a559568a009b996308ba4173d7fbe1c3fe8c15

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\base_library.zip
    Filesize

    763KB

    MD5

    dc1b529c08922e4812f714899d15b570

    SHA1

    4aae3300cb3556033e22cdb47b65d1518c4dd888

    SHA256

    faca55ba76983313bc00e8044be99332c13b58398c377c09108999d6bf339a6a

    SHA512

    2aed265d4723a8e97ac2fbed6bae1475605631f67f7987ca464b7c582b45d4cabb82ae0928396c0f756257e2c09c9b583b08bf36622f7a7694ea856101fb825c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\libcrypto-1_1.dll
    Filesize

    3.2MB

    MD5

    89511df61678befa2f62f5025c8c8448

    SHA1

    df3961f833b4964f70fcf1c002d9fd7309f53ef8

    SHA256

    296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

    SHA512

    9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\libffi-7.dll
    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\python39.dll
    Filesize

    4.3MB

    MD5

    5cd203d356a77646856341a0c9135fc6

    SHA1

    a1f4ac5cc2f5ecb075b3d0129e620784814a48f7

    SHA256

    a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a

    SHA512

    390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\select.pyd
    Filesize

    28KB

    MD5

    0e3cf5d792a3f543be8bbc186b97a27a

    SHA1

    50f4c70fce31504c6b746a2c8d9754a16ebc8d5e

    SHA256

    c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460

    SHA512

    224b42e05b4dbdf7275ee7c5d3eb190024fc55e22e38bd189c1685efee2a3dd527c6dfcb2feeec525b8d6dc35aded1eac2423ed62bb2599bb6a9ea34e842c340

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\tcl86t.dll
    Filesize

    1.6MB

    MD5

    c0b23815701dbae2a359cb8adb9ae730

    SHA1

    5be6736b645ed12e97b9462b77e5a43482673d90

    SHA256

    f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768

    SHA512

    ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\tcl\encoding\cp1252.enc
    Filesize

    1KB

    MD5

    5900f51fd8b5ff75e65594eb7dd50533

    SHA1

    2e21300e0bc8a847d0423671b08d3c65761ee172

    SHA256

    14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0

    SHA512

    ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI44602\tk86t.dll
    Filesize

    1.4MB

    MD5

    fdc8a5d96f9576bd70aa1cadc2f21748

    SHA1

    bae145525a18ce7e5bc69c5f43c6044de7b6e004

    SHA256

    1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5

    SHA512

    816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c

    Download Submit

  • C:\Users\Admin\Pictures\README.txt
    Filesize

    633B

    MD5

    a34b351043976acbff4ce0eb1a18578b

    SHA1

    f0f39a589730a005aa0e762985808ea30484797e

    SHA256

    66f2b2dc06c1956fa8e09963311841e27fbf41ecabfc8fc7b87368321a40edd1

    SHA512

    ea58e61ca53a77c955188193ad212bfb8e648676393ce762f611dbf5e931afe3e9fc6e883d9847c33132ff5dfee6dbde3064c602faf4ad4e81d22027dc59785b

    Download Submit