a4b784e94d87f8a273d86cadeb381b6f33550b356cffd8e39332bb55b97b7ba5

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 19:44

Target

2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe
Size

12.6MB
MD5

ad166d5ac571db0023402109563ca200
SHA1

f348d7863efcd15c193b25bb66d6c11cad7ba036
SHA256

a4b784e94d87f8a273d86cadeb381b6f33550b356cffd8e39332bb55b97b7ba5
SHA512

8e403175e7535311b97e722fdfe0c6692f39ed3209ad1fac64fdd3722cebfd9180744a826dfce6a296c94fe6692686e280a17100b2e3f66716fc79a4948bdb3a
SSDEEP

393216:JCg63hucsXMCHWUj5jx5WsqWxTwY3Rr69vb+:JCB3hrsXMb8ksqA/R8i

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2816	2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2816	2148	2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe	31
PID 2148 wrote to memory of 2816	2148	2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe	31
PID 2148 wrote to memory of 2816	2148	2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe	31

C:\Users\Admin\AppData\Local\Temp\2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe"
  2⤵
  - Loads dropped DLL
  PID:2816

C:\Users\Admin\AppData\Local\Temp\_MEI21482\python312.dll

Filesize
6.6MB

MD5
166cc2f997cba5fc011820e6b46e8ea7

SHA1
d6179213afea084f02566ea190202c752286ca1f

SHA256
c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

SHA512
49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

Download Submit