Overview

overview

7

Static

static

3

2025-03-30...om.exe

windows7-x64

7

2025-03-30...om.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    104s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2025, 19:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe

  • Size

    12.6MB

  • MD5

    ad166d5ac571db0023402109563ca200

  • SHA1

    f348d7863efcd15c193b25bb66d6c11cad7ba036

  • SHA256

    a4b784e94d87f8a273d86cadeb381b6f33550b356cffd8e39332bb55b97b7ba5

  • SHA512

    8e403175e7535311b97e722fdfe0c6692f39ed3209ad1fac64fdd3722cebfd9180744a826dfce6a296c94fe6692686e280a17100b2e3f66716fc79a4948bdb3a

  • SSDEEP

    393216:JCg63hucsXMCHWUj5jx5WsqWxTwY3Rr69vb+:JCB3hrsXMb8ksqA/R8i

Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 19 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5308
    • C:\Users\Admin\AppData\Local\Temp\2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-03-30_ad166d5ac571db0023402109563ca200_black-basta_cobalt-strike_satacom.exe"
      2⤵
      • Loads dropped DLL
      PID:4352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\VCRUNTIME140.dll
    Filesize

    116KB

    MD5

    be8dbe2dc77ebe7f88f910c61aec691a

    SHA1

    a19f08bb2b1c1de5bb61daf9f2304531321e0e40

    SHA256

    4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

    SHA512

    0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\VCRUNTIME140_1.dll
    Filesize

    48KB

    MD5

    f8dfa78045620cf8a732e67d1b1eb53d

    SHA1

    ff9a604d8c99405bfdbbf4295825d3fcbc792704

    SHA256

    a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

    SHA512

    ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_brotli.cp312-win_amd64.pyd
    Filesize

    802KB

    MD5

    9ad5bb6f92ee2cfd29dde8dd4da99eb7

    SHA1

    30a8309938c501b336fd3947de46c03f1bb19dc8

    SHA256

    788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8

    SHA512

    a166abcb834d6c9d6b25807adddd25775d81e2951e1bc3e9849d8ae868dedf2e1ee1b6b4b288ddfbd88a63a6fa624e2d6090aa71ded9b90c2d8cbf2d9524fdbf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_bz2.pyd
    Filesize

    83KB

    MD5

    30f396f8411274f15ac85b14b7b3cd3d

    SHA1

    d3921f39e193d89aa93c2677cbfb47bc1ede949c

    SHA256

    cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f

    SHA512

    7d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_cffi_backend.cp312-win_amd64.pyd
    Filesize

    175KB

    MD5

    fcb71ce882f99ec085d5875e1228bdc1

    SHA1

    763d9afa909c15fea8e016d321f32856ec722094

    SHA256

    86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b

    SHA512

    4a0e98ab450453fd930edc04f0f30976abb9214b693db4b6742d784247fb062c57fafafb51eb04b7b4230039ab3b07d2ffd3454d6e261811f34749f2e35f04d6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_decimal.pyd
    Filesize

    251KB

    MD5

    7ae94f5a66986cbc1a2b3c65a8d617f3

    SHA1

    28abefb1df38514b9ffe562f82f8c77129ca3f7d

    SHA256

    da8bb3d54bbba20d8fa6c2fd0a4389aec80ab6bd490b0abef5bd65097cbc0da4

    SHA512

    fbb599270066c43b5d3a4e965fb2203b085686479af157cd0bb0d29ed73248b6f6371c5158799f6d58b1f1199b82c01abe418e609ea98c71c37bb40f3226d8c5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_hashlib.pyd
    Filesize

    64KB

    MD5

    a25bc2b21b555293554d7f611eaa75ea

    SHA1

    a0dfd4fcfae5b94d4471357f60569b0c18b30c17

    SHA256

    43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d

    SHA512

    b39767c2757c65500fc4f4289cb3825333d43cb659e3b95af4347bd2a277a7f25d18359cedbdde9a020c7ab57b736548c739909867ce9de1dbd3f638f4737dc5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_lzma.pyd
    Filesize

    156KB

    MD5

    9e94fac072a14ca9ed3f20292169e5b2

    SHA1

    1eeac19715ea32a65641d82a380b9fa624e3cf0d

    SHA256

    a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f

    SHA512

    b7b3d0f737dd3b88794f75a8a6614c6fb6b1a64398c6330a52a2680caf7e558038470f6f3fc024ce691f6f51a852c05f7f431ac2687f4525683ff09132a0decb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_queue.pyd
    Filesize

    31KB

    MD5

    e1c6ff3c48d1ca755fb8a2ba700243b2

    SHA1

    2f2d4c0f429b8a7144d65b179beab2d760396bfb

    SHA256

    0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa

    SHA512

    55bfd1a848f2a70a7a55626fb84086689f867a79f09726c825522d8530f4e83708eb7caa7f7869155d3ae48f3b6aa583b556f3971a2f3412626ae76680e83ca1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_socket.pyd
    Filesize

    81KB

    MD5

    69801d1a0809c52db984602ca2653541

    SHA1

    0f6e77086f049a7c12880829de051dcbe3d66764

    SHA256

    67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3

    SHA512

    5fce77dd567c046feb5a13baf55fdd8112798818d852dfecc752dac87680ce0b89edfbfbdab32404cf471b70453a33f33488d3104cd82f4e0b94290e83eae7bb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_ssl.pyd
    Filesize

    174KB

    MD5

    90f080c53a2b7e23a5efd5fd3806f352

    SHA1

    e3b339533bc906688b4d885bdc29626fbb9df2fe

    SHA256

    fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4

    SHA512

    4b9b8899052c1e34675985088d39fe7c95bfd1bbce6fd5cbac8b1e61eda2fbb253eef21f8a5362ea624e8b1696f1e46c366835025aabcb7aa66c1e6709aab58a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\_wmi.pyd
    Filesize

    36KB

    MD5

    827615eee937880862e2f26548b91e83

    SHA1

    186346b816a9de1ba69e51042faf36f47d768b6c

    SHA256

    73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32

    SHA512

    45114caf2b4a7678e6b1e64d84b118fb3437232b4c0add345ddb6fbda87cebd7b5adad11899bdcd95ddfe83fdc3944a93674ca3d1b5f643a2963fbe709e44fb8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\base_library.zip
    Filesize

    1.3MB

    MD5

    8632d4dbbd45aacc4f20fd2eb113e4b9

    SHA1

    41dc5902c64001dbff3651096729982ac3eee217

    SHA256

    1ee6992373443b918440fb2d73722d6fa3614845cc4fd64dee040cc628aa8a6f

    SHA512

    58d84f7a03c5e714c2464756ee841267087cd8876b2bb62b6f16c8d44c54a8fd39cbdbb09e03db0b4165f1195228059c73aaa1a0388b5afb213ba8d984f5bd21

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\libcrypto-3.dll
    Filesize

    5.0MB

    MD5

    123ad0908c76ccba4789c084f7a6b8d0

    SHA1

    86de58289c8200ed8c1fc51d5f00e38e32c1aad5

    SHA256

    4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43

    SHA512

    80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\libssl-3.dll
    Filesize

    774KB

    MD5

    4ff168aaa6a1d68e7957175c8513f3a2

    SHA1

    782f886709febc8c7cebcec4d92c66c4d5dbcf57

    SHA256

    2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950

    SHA512

    c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\python3.dll
    Filesize

    66KB

    MD5

    5eace36402143b0205635818363d8e57

    SHA1

    ae7b03251a0bac083dec3b1802b5ca9c10132b4c

    SHA256

    25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2

    SHA512

    7cb3619ea46fbaaf45abfa3d6f29e7a5522777980e0a9d2da021d6c68bcc380abe38e8004e1f31d817371fb3cdd5425d4bb115cb2dc0d40d59d111a2d98b21d4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\python312.dll
    Filesize

    6.6MB

    MD5

    166cc2f997cba5fc011820e6b46e8ea7

    SHA1

    d6179213afea084f02566ea190202c752286ca1f

    SHA256

    c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

    SHA512

    49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\select.pyd
    Filesize

    30KB

    MD5

    7c14c7bc02e47d5c8158383cb7e14124

    SHA1

    5ee9e5968e7b5ce9e4c53a303dac9fc8faf98df3

    SHA256

    00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5

    SHA512

    af70cbdd882b923013cb47545633b1147ce45c547b8202d7555043cfa77c1deee8a51a2bc5f93db4e3b9cbf7818f625ca8e3b367bffc534e26d35f475351a77c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\unicodedata.pyd
    Filesize

    1.1MB

    MD5

    a8ed52a66731e78b89d3c6c6889c485d

    SHA1

    781e5275695ace4a5c3ad4f2874b5e375b521638

    SHA256

    bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7

    SHA512

    1c131911f120a4287ebf596c52de047309e3be6d99bc18555bd309a27e057cc895a018376aa134df1dc13569f47c97c1a6e8872acedfa06930bbf2b175af9017

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI53082\zstandard\backend_c.cp312-win_amd64.pyd
    Filesize

    508KB

    MD5

    0fc69d380fadbd787403e03a1539a24a

    SHA1

    77f067f6d50f1ec97dfed6fae31a9b801632ef17

    SHA256

    641e0b0fa75764812fff544c174f7c4838b57f6272eaae246eb7c483a0a35afc

    SHA512

    e63e200baf817717bdcde53ad664296a448123ffd055d477050b8c7efcab8e4403d525ea3c8181a609c00313f7b390edbb754f0a9278232ade7cfb685270aaf0

    Download Submit