Resubmissions
28/03/2025, 22:50
250328-2r89gsvly8 1026/03/2025, 18:56
250326-xlfmrssqz9 1026/03/2025, 18:17
250326-wxdf4szyc1 10Analysis
-
max time kernel
66s -
max time network
65s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
-
submitted
28/03/2025, 22:50
General
-
Target
2025-03-26_17cc347c7c544e98a18dacf02a25d619_black-basta_cobalt-strike_satacom.exe
-
Size
502KB
-
MD5
17cc347c7c544e98a18dacf02a25d619
-
SHA1
263aa440a706fe3aa909fd8b212185340e7ede94
-
SHA256
30a4d2ae21ec90ebdd415b90d2fe670ac5c0ffe54d0d8f7a01a54910ba1a8c45
-
SHA512
e686ac882f4fdbe0efb0833186640d61d75b3132d026e5f2e1da35a01efca371e63cea3953a33dfb29ce130e6b3e0103bfbda099fc3da092364cc43427e15aeb
-
SSDEEP
6144:eo2mNDxqElXchsLP3JRBNGJLEAxSKfC5ogn3WJGBV50DErWuuzgXmPdt:eo2BYd73FWLExKfcoaWJtDTv
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Renames multiple (135) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies data under HKEY_USERS 18 IoCs
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 48 IoCs
-
Suspicious use of SendNotifyMessage 47 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-26_17cc347c7c544e98a18dacf02a25d619_black-basta_cobalt-strike_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-26_17cc347c7c544e98a18dacf02a25d619_black-basta_cobalt-strike_satacom.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
666KB
MD5dfc8e48664443ea38b7336b9e041c761
SHA129256b48b1ae0075d20d202a1bc58a2a0babe773
SHA256e9bf9e97e828f0369de8335b72fbf1a3834f200889ca185e449142e6d6af3829
SHA512c2caa8e646b0e43ad17686ee816b13c96008a50582d03a02347ca5d2b328f79a7fb79276b3f9c7ee50f59ba9b4e94a84a016ac458f307baff68a9f07fee72232
-
Filesize
14KB
MD58c16fd094b6a0c881ee26fe1e48b1f61
SHA1f5cf9d0f82562c43690cf70ce9542e8cebee828c
SHA256db2c5f4f5916f6a2abb196d54b2103a77d026d3ed75981aa1b5efd1aa33ac4da
SHA5128ad0e4f48779ec9fc0aa98b0cbfbca51fbf1496b1fbba6d1774bd3bbdd4cce5c73b79c87bb3f29356199e16578b126feef05bd12c3c042b8e72e9d0927ba7812
-
Filesize
439KB
MD575db8b81efaece0378298f91e125625d
SHA1d070b0d046f8c968a7645fc708e059eb9926c65b
SHA25685b6a8f878f8eda1fc66e3f9ff0f033bbce6a74ac5ff3c8ee7302a2c65faec8a
SHA512b22ca65296cb020e5237053132cba2a4b30a1f1f721a49b8d6e71675e40d61372898dfc0750201388118a55f01a7a355608d91b565e58138010732fc33d6bdae
-
Filesize
634KB
MD5cd0d47580abe42f987df2ec0a0fa731a
SHA1a2d5f0d3e021a1ebb9507bd56249d0e4edc93ebc
SHA25657e99b4e9ef64eb2901f8804f72fa002e5614c509c36d81fe81200c0e8d1d469
SHA5125604a7d2e5270350e872d2728460aeabf40ecce0c9ef2f819cac23aed72cc531b2dee30e2b74a1964141b7d4737b059e03e3edeb775bfec03b00c700801ac550
-
Filesize
504KB
MD565a9050c5642a6cd625548fe4bff088d
SHA16af671bf6697e940266b5fcda9872ddd205bbef6
SHA256699d1c2657a03d2731daf972e05b83dfb0ddfbf835203b8d12919003e83e3280
SHA512997777e69f9bc3f5d05aa20e183ae7c6b0cde5ecdc2af4fc936b7b01c25a5f5f1b0eaea000ba924d4187f35f1bf36d2e1349255c2642724cfdb9b14177008de0
-
Filesize
731KB
MD5161e718dabbdcf754fe314df8faeea46
SHA171cf3e4bead1fb147b23ab3577b0cd291c54bcde
SHA25695beb0f70fea1c2614835a68ab538608abaa4baf785092b3de8f7479399386e3
SHA51275d9a5a34b74c59eb864e904f31a14a2778d2a498e93d1ebac27c99864146bd039b82fbe2a79dba0cb9ae7fc5f5e560f980bae8571629b7849023d1d3ab3dd57
-
Filesize
829KB
MD54e4e99f5fbff5b318178c2bdc04b797b
SHA1d12a8600c1fb5a61eea33d1c0b9d91a0f1cca1be
SHA256ced1e07ca1a7936f43f79eaa6716b3753a440a41c5c2494c067a2e360d560c9a
SHA512b5966acc98d47f1e45c845474d635d73d33d9dce7caabd6d68d37a67adf2b522a4b036ba2e04af6f95feed26fd5668d595813f33fed9700a8276ee8ab493a0e5
-
Filesize
926KB
MD508458e1dec2798781bc3033fb334d056
SHA18360ba633d346e43dc34a4e5c764f9c271c3f13a
SHA25600c8463c9247ddffe3bb6a9a484e67d4e14024ed1ab04814ac70aba674de6289
SHA51275b6513a5e560fffd4a8bf405cfd913edd5a9fd25381de8f188befebb45a124508f98de74a6feef2067339645ef812bb51b114c6440d2ccee251db26d35ebc4d
-
Filesize
601KB
MD500dfd1680ed80aad620b963f623ab206
SHA14f177106a0467735d2097a64489b1ac95e60cdb4
SHA25685536ec7744e050f20df54d2d397e6c73cb2ba7529d8a785491638e607b769ea
SHA512f411def25a1d42c78382e58f9885424a0fdbe5bd02b0f236f028288c5c90479d71bed452c490c40de57cd34f81de82e2949a521fd4cea8b9b3a93c8fa3cadf4d
-
Filesize
569KB
MD5ff9c7c589e7299be3b37acd095a9f266
SHA186b3f58c2810286194d0f284c4ccc669aaa3b3c3
SHA2562931338c243c2a4af568d08866196f3c4bd31daa8c80d05d164fc18e8c5ab7ba
SHA51261835c0543bd51592d4a1799960379cac28ef239afe956511a05a7d25a67303bfd3bb8ab8af24da20cfc58a8fab814417a49b9fa016b95c7679de4972d91da21
-
Filesize
894KB
MD5544a47c187be0e90e5e9ada305cec37e
SHA18a20ee24dae3c7602ed609fc5b91ce6c7a1f6813
SHA256f92c8e173ae5407450864aaf9bb25854c1d65abec670f5eb33a8aa318b766109
SHA512f47f7995ba6540bf4e0700eeacac29429358fc4f5c8ba44daeab3cf3f91ece17f29e980705a2604c5c2d3dd2a7a19bf807d27930354cd6bf0e124034b4b708cb
-
Filesize
1.3MB
MD5e15331e1ad1d1511f4bc41f8f38ed895
SHA15d98204893e9c8f82c81b69ffe3c804632ff439c
SHA256f79f43a6787d24b8dd869133788768e3e8436a846fe2bcfdc9b2ededefc61d2e
SHA512d981b41d857ffb6ede40a701e0b158653c77b98c0bd94030f626de8319ed1ca4ca29e2e1b4c0f41cd0e39250f870f1b13dc59bbff92367a8e0cd78255d8c0368
-
Filesize
341KB
MD5edbad7c7d2fb0402ad5cf562c66ebc4a
SHA17ab50ac90b4a406eb8cffb13a036c14e24fd490c
SHA256de068dc50ceeabfc6851a3db88e1b021c3438b5f12806817cb5a89a8634a84ba
SHA5122d997f6be0d1b5df92a30dc665a9f73b723bf86d707af9c1fc7e666533c2577ab9aa8100e147cfeaac77c9f4210251012c840e5d24357c9ed03aa035433ad447
-
Filesize
699KB
MD5daca80aa5057651e83b5fdc16d0eae89
SHA16df054d03d8efed5099cf472f62507959c814864
SHA256abeac4ea8c196e835ad572c3f03963d0048d977b355a1b5333004759912824ea
SHA5121d52e5ec9a404eb109ef0ba6d85323621fc0a41ad6381cbc728e42af7f01591984e041a1453a4e20e56630ecb7a155524a7d28f87d5125a7fc269348d2a1b7ec
-
Filesize
536KB
MD52f8afdb98322549d38ddffaef743c256
SHA1495847d7debff1e879584003620897aef311ff30
SHA256e7bdc982770cf493ec0513049d0567483b38407800390a61957dc07e4626eda7
SHA5124e8b071b835f564fb9f85880e338ec2d01001cefafc20d65ece5073d73855a7b80e8dc5f6763b7bc83fef9aa7979a94f33299d5242bbf6f9c1f11c9cccdc9444
-
Filesize
796KB
MD550000bae2f63a775a0e6f299bcd84f26
SHA1962145f2b545ddd68f0d992024f27a25b6955e14
SHA25687ab04ba37a7959f8eb7c0237682b3f1dd5043307aba9816d0ca61a1754e4eca
SHA51213bbb2cb22accde1c87caffa962d8d2a2241900f054ff4c92ef80d71154c802171b5dd719e129a9b908598cebad7fbff0f06876c6dd0265270d11529058448a4
-
Filesize
471KB
MD59a36fea31e2f605b7b850a7f8e5e4d0f
SHA134cdc7c67aef6d76bf3dada805a4001f60f5d948
SHA25644129dcab81ffca5e4b8f7cace008d47c3fccb5775f2b9c689e0493771cbad22
SHA51281b813f28dc4c8248a8fc49083a6f2e410654e49f93ae7c0c97c9adbdb19d7de8df19fb53227ee7f49889daccc2b3b0578bf1da31a0bab7fd848ab79e7c60531
-
Filesize
764KB
MD5f0e0bc0a4cc379cf2a2daf56d0984073
SHA1b2fb5a8e783e37ab657b83f61e6eec9f27fe53ad
SHA256dbcc7dab8f272a49521c871293a728463682a4957b516625b8d453aed0b589cd
SHA512d20ac04c711c98e2f567d25245dc617b020a7b61890a9f03b6d08335d81357c88c965f63e0cd5628368a4f73e0cf601a89b891cf3b650d9f98d9a956ba2a42be
-
Filesize
861KB
MD52167085008d9a17136be09bdaac62b80
SHA119dc99e0b6ace8c71db5e92af47412a3d934c01a
SHA256dbd38baa3704c5d6ed86f94a470d8dbba53ff4c07b53f8fcbeb7500d8e83a46f
SHA512608ec24b964a30cf3358c155d7767220ac0a1705936485d66ae103ead5efce356aedcd4ad76f92d215574013535c1afacd43b7b163250fc1d8cc870fad068037
-
Filesize
12KB
MD5848077dfd7a5254d85116bd82284dc81
SHA1e80353b0701eef7eac35df619278c70cdcbb8573
SHA256b3c59524150d6ca86175f69676b23dc05cfe72fd93609cfe6cad994cabf29ca2
SHA512136abfc162844af4eaf2e35ed816152c502e5c57cd4750d4ae7a61e094102ed70711d55d4140b59ee31112969787d627aaeab95b70ddfe544076d68b431d8cfb
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB