8a64254e4afe98ba46804aa9fb460aa12976dc3750933cb8ba7dda9e3d23a414

General

Target

2025-04-13_bbc5a78bd5edd1a3bb50bb368a700e99_black-basta_cobalt-strike_satacom.exe
Size

4.9MB
MD5

bbc5a78bd5edd1a3bb50bb368a700e99
SHA1

a65fac89b1e3b06286d07eb6a1129af7d64c4e30
SHA256

8a64254e4afe98ba46804aa9fb460aa12976dc3750933cb8ba7dda9e3d23a414
SHA512

e24cdcbbfb12e6c15f7b4bad99b7264160368daa59d5b55c6efcca56a892de75dc5e6b750be53d1b3c7e08df80dc931e8f69f48af48f7dbe83ba9e6044303d8b
SSDEEP

98304:WxWovdiForGveUuGTyF1MSEL6mPJ7vCkoWPAmb8HJJxB:WxWov8FWqeUuG+E/LdPUJo/b8rxB

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	2025-04-13_bbc5a78bd5edd1a3bb50bb368a700e99_black-basta_cobalt-strike_satacom.exe

Executes dropped EXE 1 IoCs

pid	Process
3832	CamMenuMaker.exe

Loads dropped DLL 5 IoCs

pid	Process
3832	CamMenuMaker.exe
3832	CamMenuMaker.exe
3832	CamMenuMaker.exe
3832	CamMenuMaker.exe
3832	CamMenuMaker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4448	3832	WerFault.exe	86
4624	3832	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CamMenuMaker.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3832	CamMenuMaker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 3832	1096	2025-04-13_bbc5a78bd5edd1a3bb50bb368a700e99_black-basta_cobalt-strike_satacom.exe	86
PID 1096 wrote to memory of 3832	1096	2025-04-13_bbc5a78bd5edd1a3bb50bb368a700e99_black-basta_cobalt-strike_satacom.exe	86
PID 1096 wrote to memory of 3832	1096	2025-04-13_bbc5a78bd5edd1a3bb50bb368a700e99_black-basta_cobalt-strike_satacom.exe	86

C:\Users\Admin\AppData\Local\Temp\2025-04-13_bbc5a78bd5edd1a3bb50bb368a700e99_black-basta_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-13_bbc5a78bd5edd1a3bb50bb368a700e99_black-basta_cobalt-strike_satacom.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\CamMenuMaker.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CamMenuMaker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 532
    3⤵
    - Program crash
    PID:4448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 540
    3⤵
    - Program crash
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3832 -ip 3832
1⤵
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3832 -ip 3832
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\CamMenuMaker.exe

Filesize
1.1MB

MD5
0aa5410c7565c20aebbb56a317e578da

SHA1
1b5fd5739d66cdbb3d08b3d11b45bf49851bc4e0

SHA256
88a1f9a40eb7ece8999092b2872b6afde0fb3776e29384c5b00631bb0fca34d1

SHA512
4d45855719ac2846c5b49a69f4680200cfe0b325a476c3d6624f5bfd56212ccf9858394c0deb98fdca0ed44e8b63720eadcc67577fdbb874c07d9f15b41e4056

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSVCP100.dll

Filesize
411KB

MD5
bc83108b18756547013ed443b8cdb31b

SHA1
79bcaad3714433e01c7f153b05b781f8d7cb318d

SHA256
b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671

SHA512
6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\XceedZip.dll

Filesize
484KB

MD5
882e0b32bbc7babec02c0f84b4bd45e0

SHA1
13a9012191b5a59e1e3135c3953e8af63eb1b513

SHA256
2d04cc1948c4b8249e5eb71934006fe5dda4db7c856698fb8f2521a77e73f572

SHA512
99e314733e6a9eb5b5e5e973d54d4aac8f7aef119cd8f650da0690a46eaaa9c2157cdf0ddc912cbda81587b484b2b88d0b6833c8c4e4c320182d5e584062dd0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\kaisership.xls

Filesize
64KB

MD5
3227dee0de54cf0d4170d4239cf20909

SHA1
30c00ea284a20dc97e192e7b721d4ac7f6099380

SHA256
4ef6d5749c33f3cdb2540fe75f190656e280fb692b28a5b4c89d77d44838f846

SHA512
ce11b7b91b4e7c3faf8b70c92447566c150d8b59055cfbe5bb32b16c66b307d69bffeb7da7e1c0f0c7949b5adb5c9afeb17f27062a196302c7d9a61bdf10ae24

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mfc100enu.dll

Filesize
53KB

MD5
2a2c442f00b45e01d4c882eea69a01bc

SHA1
85145f0f784d3a4efa569deb77b54308a1a21b92

SHA256
d71db839de0bc1fcc01a125d57ced2aaea3f444a992426c316ce18c267c33a8c

SHA512
f18d9019eee843d707aa307714a15207be2ded2eceab518599fbed8a3826a1a56f815fe75fb37f36c93be13f3d90e025f790db6b3ba413bfd5cd040b2cc7dbf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mfc100u.dll

Filesize
4.2MB

MD5
2176c58274faa1ab11c40225454ca868

SHA1
a30cfa3565faf06f329d965a70335aa0b4a698ba

SHA256
26ba264ca0f4a0f6daa53b49529a0edec871b0bfdecd411c86ff2319d4bf9094

SHA512
12ee797402ce74a9b3c69a7180feac84c1e801d55e86750609327b977d521b965233dba30fe37713732afbc6a6e555bdbf9b02b055c1eb53a0a839e9490e47a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit

Analysis

Sharing