dcb98b03965b00384f03c8be98b99059aad75de53bbf7ef1fc24e954d566d221

Analysis

max time kernel
150s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
03/05/2025, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Size 9.3MB
Sample250503-ejtgqsywez
SHA256 dcb98b03965b00384f03c8be98b99059aad75de53bbf7ef1fc24e954d566d221
MD5 c124d1c641c515d99194d553568f830a
SHA1 09b9ca6a96a6fff467b7bee404aa4a9edcb07ff9
SHA512 7e64603543b67bd665956446566eb1c517fba35ae5d34e59f861f17e0fed4f9caef3a22e38dee8efdcaf65981559f58cc1e474a088937de59b9648dfbb01c074
SSDEEP 98304:HGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:A1eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery persistence ransomware trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Kazekage.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Gaara.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Disables RegEdit via registry modification 6 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system32.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 24 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	Kazekage.exe

Executes dropped EXE 30 IoCs

pid	Process
4764	smss.exe
5244	smss.exe
5972	Gaara.exe
5392	smss.exe
4852	Gaara.exe
4828	csrss.exe
5672	smss.exe
3612	Gaara.exe
2424	csrss.exe
5568	Kazekage.exe
1740	smss.exe
1668	Gaara.exe
3468	csrss.exe
1592	Kazekage.exe
2252	system32.exe
5864	smss.exe
4736	Gaara.exe
5108	csrss.exe
1140	Kazekage.exe
4412	system32.exe
3576	system32.exe
780	Kazekage.exe
676	system32.exe
5528	csrss.exe
3064	Kazekage.exe
1456	system32.exe
5260	Gaara.exe
3836	csrss.exe
1376	Kazekage.exe
2052	system32.exe

Loads dropped DLL 18 IoCs

pid	Process
4764	smss.exe
5244	smss.exe
5972	Gaara.exe
5392	smss.exe
4852	Gaara.exe
4828	csrss.exe
5672	smss.exe
3612	Gaara.exe
2424	csrss.exe
1740	smss.exe
1668	Gaara.exe
3468	csrss.exe
5864	smss.exe
4736	Gaara.exe
5108	csrss.exe
5528	csrss.exe
5260	Gaara.exe
3836	csrss.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "3-5-2025.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 3 - 5 - 2025\\Gaara.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 3 - 5 - 2025\\smss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Kazekage.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	\??\E:\Desktop.ini	system32.exe
File opened for modification	\??\B:\Desktop.ini	smss.exe
File opened for modification	\??\G:\Desktop.ini	csrss.exe
File opened for modification	\??\J:\Desktop.ini	csrss.exe
File opened for modification	\??\R:\Desktop.ini	csrss.exe
File opened for modification	\??\U:\Desktop.ini	csrss.exe
File opened for modification	\??\G:\Desktop.ini	Gaara.exe
File opened for modification	\??\P:\Desktop.ini	Gaara.exe
File opened for modification	\??\G:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\N:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\R:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\M:\Desktop.ini	Kazekage.exe
File opened for modification	\??\O:\Desktop.ini	smss.exe
File opened for modification	\??\L:\Desktop.ini	Gaara.exe
File opened for modification	\??\A:\Desktop.ini	smss.exe
File opened for modification	\??\R:\Desktop.ini	smss.exe
File opened for modification	\??\K:\Desktop.ini	Gaara.exe
File opened for modification	\??\I:\Desktop.ini	csrss.exe
File opened for modification	\??\J:\Desktop.ini	system32.exe
File opened for modification	\??\X:\Desktop.ini	smss.exe
File opened for modification	\??\Q:\Desktop.ini	csrss.exe
File opened for modification	C:\Desktop.ini	Gaara.exe
File opened for modification	\??\A:\Desktop.ini	csrss.exe
File opened for modification	\??\P:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\R:\Desktop.ini	Kazekage.exe
File opened for modification	\??\K:\Desktop.ini	system32.exe
File opened for modification	\??\K:\Desktop.ini	smss.exe
File opened for modification	\??\H:\Desktop.ini	csrss.exe
File opened for modification	\??\E:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\I:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Y:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\V:\Desktop.ini	Kazekage.exe
File opened for modification	\??\O:\Desktop.ini	system32.exe
File opened for modification	\??\Z:\Desktop.ini	system32.exe
File opened for modification	\??\V:\Desktop.ini	Gaara.exe
File opened for modification	\??\J:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\H:\Desktop.ini	Kazekage.exe
File opened for modification	\??\J:\Desktop.ini	Kazekage.exe
File opened for modification	\??\S:\Desktop.ini	Kazekage.exe
File opened for modification	\??\X:\Desktop.ini	Kazekage.exe
File opened for modification	\??\T:\Desktop.ini	system32.exe
File opened for modification	\??\W:\Desktop.ini	smss.exe
File opened for modification	\??\I:\Desktop.ini	Gaara.exe
File opened for modification	\??\J:\Desktop.ini	Gaara.exe
File opened for modification	\??\Y:\Desktop.ini	Kazekage.exe
File opened for modification	D:\Desktop.ini	system32.exe
File opened for modification	\??\V:\Desktop.ini	system32.exe
File opened for modification	\??\W:\Desktop.ini	Kazekage.exe
File opened for modification	\??\A:\Desktop.ini	Gaara.exe
File opened for modification	\??\N:\Desktop.ini	csrss.exe
File opened for modification	\??\Z:\Desktop.ini	csrss.exe
File opened for modification	\??\S:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\U:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\N:\Desktop.ini	system32.exe
File opened for modification	\??\H:\Desktop.ini	smss.exe
File opened for modification	\??\T:\Desktop.ini	smss.exe
File opened for modification	\??\W:\Desktop.ini	Gaara.exe
File opened for modification	\??\Y:\Desktop.ini	Gaara.exe
File opened for modification	\??\G:\Desktop.ini	system32.exe
File opened for modification	\??\M:\Desktop.ini	csrss.exe
File opened for modification	\??\W:\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\L:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Q:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Z:\Desktop.ini	Kazekage.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Kazekage.exe
File opened (read-only)	\??\S:	system32.exe
File opened (read-only)	\??\J:	smss.exe
File opened (read-only)	\??\U:	smss.exe
File opened (read-only)	\??\M:	csrss.exe
File opened (read-only)	\??\R:	Kazekage.exe
File opened (read-only)	\??\Y:	Kazekage.exe
File opened (read-only)	\??\K:	Gaara.exe
File opened (read-only)	\??\R:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\H:	Kazekage.exe
File opened (read-only)	\??\U:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\V:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\N:	Kazekage.exe
File opened (read-only)	\??\Z:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\B:	smss.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\Q:	system32.exe
File opened (read-only)	\??\A:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\W:	Kazekage.exe
File opened (read-only)	\??\Q:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\O:	Kazekage.exe
File opened (read-only)	\??\Z:	system32.exe
File opened (read-only)	\??\H:	Gaara.exe
File opened (read-only)	\??\K:	csrss.exe
File opened (read-only)	\??\L:	csrss.exe
File opened (read-only)	\??\Z:	Kazekage.exe
File opened (read-only)	\??\H:	system32.exe
File opened (read-only)	\??\P:	Gaara.exe
File opened (read-only)	\??\E:	csrss.exe
File opened (read-only)	\??\R:	csrss.exe
File opened (read-only)	\??\Y:	smss.exe
File opened (read-only)	\??\H:	csrss.exe
File opened (read-only)	\??\G:	Gaara.exe
File opened (read-only)	\??\I:	Gaara.exe
File opened (read-only)	\??\X:	Gaara.exe
File opened (read-only)	\??\K:	system32.exe
File opened (read-only)	\??\X:	system32.exe
File opened (read-only)	\??\E:	Kazekage.exe
File opened (read-only)	\??\A:	smss.exe
File opened (read-only)	\??\V:	Gaara.exe
File opened (read-only)	\??\S:	csrss.exe
File opened (read-only)	\??\L:	Gaara.exe
File opened (read-only)	\??\T:	Gaara.exe
File opened (read-only)	\??\A:	Kazekage.exe
File opened (read-only)	\??\J:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\S:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\B:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\A:	Gaara.exe
File opened (read-only)	\??\U:	Gaara.exe
File opened (read-only)	\??\Q:	csrss.exe
File opened (read-only)	\??\P:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\T:	Kazekage.exe
File opened (read-only)	\??\Y:	csrss.exe
File opened (read-only)	\??\Z:	csrss.exe
File opened (read-only)	\??\N:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\V:	Kazekage.exe
File opened (read-only)	\??\E:	system32.exe
File opened (read-only)	\??\Y:	system32.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\M:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\M:	Kazekage.exe
File opened (read-only)	\??\B:	system32.exe
File opened (read-only)	\??\O:	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\I:	system32.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\H:\Autorun.inf	smss.exe
File opened for modification	\??\I:\Autorun.inf	csrss.exe
File created	\??\E:\Autorun.inf	system32.exe
File opened for modification	\??\N:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	D:\Autorun.inf	system32.exe
File created	\??\X:\Autorun.inf	system32.exe
File created	\??\X:\Autorun.inf	csrss.exe
File created	\??\M:\Autorun.inf	Kazekage.exe
File opened for modification	\??\N:\Autorun.inf	system32.exe
File created	D:\Autorun.inf	smss.exe
File opened for modification	\??\L:\Autorun.inf	Gaara.exe
File created	D:\Autorun.inf	csrss.exe
File created	\??\S:\Autorun.inf	csrss.exe
File created	\??\B:\Autorun.inf	Kazekage.exe
File opened for modification	\??\I:\Autorun.inf	Kazekage.exe
File opened for modification	\??\K:\Autorun.inf	Kazekage.exe
File opened for modification	\??\B:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	F:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\K:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\I:\Autorun.inf	smss.exe
File created	\??\V:\Autorun.inf	Gaara.exe
File created	\??\Y:\Autorun.inf	Gaara.exe
File opened for modification	\??\T:\Autorun.inf	Kazekage.exe
File created	\??\U:\Autorun.inf	Kazekage.exe
File created	\??\G:\Autorun.inf	csrss.exe
File opened for modification	\??\T:\Autorun.inf	csrss.exe
File created	\??\K:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\K:\Autorun.inf	smss.exe
File opened for modification	\??\Q:\Autorun.inf	smss.exe
File created	\??\H:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\J:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\T:\Autorun.inf	csrss.exe
File opened for modification	\??\G:\Autorun.inf	Kazekage.exe
File opened for modification	\??\L:\Autorun.inf	Kazekage.exe
File created	\??\T:\Autorun.inf	Kazekage.exe
File opened for modification	\??\J:\Autorun.inf	system32.exe
File opened for modification	\??\U:\Autorun.inf	system32.exe
File created	\??\N:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\E:\Autorun.inf	Gaara.exe
File opened for modification	\??\H:\Autorun.inf	system32.exe
File opened for modification	\??\K:\Autorun.inf	system32.exe
File opened for modification	\??\I:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\P:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\Z:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\Z:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\K:\Autorun.inf	Kazekage.exe
File opened for modification	\??\R:\Autorun.inf	Kazekage.exe
File opened for modification	\??\W:\Autorun.inf	system32.exe
File opened for modification	C:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\P:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\Y:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\T:\Autorun.inf	smss.exe
File opened for modification	C:\Autorun.inf	Gaara.exe
File opened for modification	\??\H:\Autorun.inf	Gaara.exe
File opened for modification	\??\S:\Autorun.inf	Gaara.exe
File created	\??\I:\Autorun.inf	csrss.exe
File created	\??\A:\Autorun.inf	smss.exe
File opened for modification	\??\A:\Autorun.inf	Gaara.exe
File opened for modification	\??\H:\Autorun.inf	Kazekage.exe
File opened for modification	\??\O:\Autorun.inf	system32.exe
File created	\??\T:\Autorun.inf	system32.exe
File created	\??\B:\Autorun.inf	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\I:\Autorun.inf	Kazekage.exe
File created	\??\X:\Autorun.inf	Kazekage.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\	Kazekage.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File created	C:\Windows\SysWOW64\3-5-2025.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	Gaara.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	csrss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	system32.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	smss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	smss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\Desktop.ini	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\3-5-2025.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\	system32.exe

Sets desktop wallpaper using registry 2 TTPs 6 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2228-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b21f-11.dat	upx
behavioral2/files/0x001900000002b21b-31.dat	upx
behavioral2/memory/4764-33-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b21f-46.dat	upx
behavioral2/files/0x001900000002b220-49.dat	upx
behavioral2/memory/5244-70-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5972-77-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b21e-78.dat	upx
behavioral2/memory/5244-75-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b21f-85.dat	upx
behavioral2/files/0x001900000002b220-89.dat	upx
behavioral2/files/0x001900000002b220-90.dat	upx
behavioral2/memory/4852-115-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4852-119-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4828-124-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b220-130.dat	upx
behavioral2/memory/2424-166-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5568-171-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5972-205-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1592-213-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b222-208.dat	upx
behavioral2/memory/4736-242-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/780-262-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2252-270-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1456-281-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5260-285-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1376-292-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2052-296-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3064-274-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/676-266-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3576-258-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4412-254-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5568-250-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1140-249-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4828-235-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b220-223.dat	upx
behavioral2/memory/2252-217-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b223-216.dat	upx
behavioral2/memory/1668-204-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b220-177.dat	upx
behavioral2/memory/4764-170-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2228-162-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3612-161-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b223-138.dat	upx
behavioral2/memory/2228-297-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4764-298-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5972-299-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4828-300-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2252-302-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5568-301-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2228-315-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4764-401-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5972-448-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b26b-494.dat	upx
behavioral2/memory/4828-506-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2252-569-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5568-579-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Gaara.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Gaara.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	system32.exe
File opened for modification	C:\Windows\	system32.exe
File opened for modification	C:\Windows\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	csrss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	Kazekage.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	Gaara.exe
File opened for modification	C:\Windows\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	Kazekage.exe
File created	C:\Windows\Fonts\The Kazekage.jpg	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	smss.exe
File opened for modification	C:\Windows\	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\WBEM\msvbvm60.dll	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	Gaara.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	system32.exe
File opened for modification	C:\Windows\msvbvm60.dll	system32.exe
File created	C:\Windows\mscomctl.ocx	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\	smss.exe
File opened for modification	C:\Windows\	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	smss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	system32.exe
File created	C:\Windows\msvbvm60.dll	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\system\mscoree.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	system32.exe
File created	C:\Windows\system\msvbvm60.dll	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	Gaara.exe
File opened for modification	C:\Windows\system\mscoree.dll	Kazekage.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	smss.exe
File opened for modification	C:\Windows\system\mscoree.dll	smss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\msvbvm60.dll	system32.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\msvbvm60.dll	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	Gaara.exe
File created	C:\Windows\WBEM\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\system\mscoree.dll	system32.exe
File opened for modification	C:\Windows\	Gaara.exe
File opened for modification	C:\Windows\msvbvm60.dll	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	smss.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\msvbvm60.dll	smss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe	Gaara.exe
File opened for modification	C:\Windows\msvbvm60.dll	Gaara.exe
File created	C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe	Kazekage.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 36 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3260	ping.exe
5552	ping.exe
2040	ping.exe
1668	ping.exe
1080	ping.exe
3536	ping.exe
5064	ping.exe
2052	ping.exe
1136	ping.exe
5784	ping.exe
5372	ping.exe
5760	ping.exe
3284	ping.exe
4268	ping.exe
276	ping.exe
2816	ping.exe
3716	ping.exe
3612	ping.exe
1572	ping.exe
2444	ping.exe
1916	ping.exe
3128	ping.exe
3612	ping.exe
5652	ping.exe
4004	ping.exe
1352	ping.exe
1140	ping.exe
656	ping.exe
5340	ping.exe
3420	ping.exe
5668	ping.exe
4212	ping.exe
1780	ping.exe
4396	ping.exe
1108	ping.exe
5168	ping.exe

Modifies Control Panel 64 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\WallpaperStyle = "2"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Size = "72"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Size = "72"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Size = "72"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\WallpaperStyle = "2"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\WallpaperStyle = "2"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\WallpaperStyle = "2"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\WallpaperStyle = "2"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	smss.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	smss.exe

Runs ping.exe 1 TTPs 36 IoCs

Remote System Discovery

T1018

pid	Process
3128	ping.exe
3612	ping.exe
1136	ping.exe
1140	ping.exe
5340	ping.exe
3716	ping.exe
3612	ping.exe
5168	ping.exe
4268	ping.exe
2052	ping.exe
3260	ping.exe
2040	ping.exe
1668	ping.exe
1572	ping.exe
5552	ping.exe
1916	ping.exe
5668	ping.exe
4396	ping.exe
3284	ping.exe
276	ping.exe
3420	ping.exe
1080	ping.exe
3536	ping.exe
1780	ping.exe
4004	ping.exe
2444	ping.exe
5760	ping.exe
4212	ping.exe
1352	ping.exe
656	ping.exe
5372	ping.exe
5064	ping.exe
5784	ping.exe
5652	ping.exe
2816	ping.exe
1108	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
5972	Gaara.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
4764	smss.exe
5244	smss.exe
5972	Gaara.exe
5392	smss.exe
4852	Gaara.exe
4828	csrss.exe
5672	smss.exe
3612	Gaara.exe
2424	csrss.exe
5568	Kazekage.exe
1740	smss.exe
1668	Gaara.exe
3468	csrss.exe
1592	Kazekage.exe
2252	system32.exe
5864	smss.exe
4736	Gaara.exe
5108	csrss.exe
1140	Kazekage.exe
4412	system32.exe
3576	system32.exe
780	Kazekage.exe
676	system32.exe
5528	csrss.exe
3064	Kazekage.exe
1456	system32.exe
5260	Gaara.exe
3836	csrss.exe
1376	Kazekage.exe
2052	system32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4764	2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe	83
PID 2228 wrote to memory of 4764	2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe	83
PID 2228 wrote to memory of 4764	2228	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe	83
PID 4764 wrote to memory of 5244	4764	smss.exe	85
PID 4764 wrote to memory of 5244	4764	smss.exe	85
PID 4764 wrote to memory of 5244	4764	smss.exe	85
PID 4764 wrote to memory of 5972	4764	smss.exe	86
PID 4764 wrote to memory of 5972	4764	smss.exe	86
PID 4764 wrote to memory of 5972	4764	smss.exe	86
PID 5972 wrote to memory of 5392	5972	Gaara.exe	87
PID 5972 wrote to memory of 5392	5972	Gaara.exe	87
PID 5972 wrote to memory of 5392	5972	Gaara.exe	87
PID 5972 wrote to memory of 4852	5972	Gaara.exe	88
PID 5972 wrote to memory of 4852	5972	Gaara.exe	88
PID 5972 wrote to memory of 4852	5972	Gaara.exe	88
PID 5972 wrote to memory of 4828	5972	Gaara.exe	89
PID 5972 wrote to memory of 4828	5972	Gaara.exe	89
PID 5972 wrote to memory of 4828	5972	Gaara.exe	89
PID 4828 wrote to memory of 5672	4828	csrss.exe	90
PID 4828 wrote to memory of 5672	4828	csrss.exe	90
PID 4828 wrote to memory of 5672	4828	csrss.exe	90
PID 4828 wrote to memory of 3612	4828	csrss.exe	91
PID 4828 wrote to memory of 3612	4828	csrss.exe	91
PID 4828 wrote to memory of 3612	4828	csrss.exe	91
PID 4828 wrote to memory of 2424	4828	csrss.exe	92
PID 4828 wrote to memory of 2424	4828	csrss.exe	92
PID 4828 wrote to memory of 2424	4828	csrss.exe	92
PID 4828 wrote to memory of 5568	4828	csrss.exe	93
PID 4828 wrote to memory of 5568	4828	csrss.exe	93
PID 4828 wrote to memory of 5568	4828	csrss.exe	93
PID 5568 wrote to memory of 1740	5568	Kazekage.exe	94
PID 5568 wrote to memory of 1740	5568	Kazekage.exe	94
PID 5568 wrote to memory of 1740	5568	Kazekage.exe	94
PID 5568 wrote to memory of 1668	5568	Kazekage.exe	95
PID 5568 wrote to memory of 1668	5568	Kazekage.exe	95
PID 5568 wrote to memory of 1668	5568	Kazekage.exe	95
PID 5568 wrote to memory of 3468	5568	Kazekage.exe	96
PID 5568 wrote to memory of 3468	5568	Kazekage.exe	96
PID 5568 wrote to memory of 3468	5568	Kazekage.exe	96
PID 5568 wrote to memory of 1592	5568	Kazekage.exe	97
PID 5568 wrote to memory of 1592	5568	Kazekage.exe	97
PID 5568 wrote to memory of 1592	5568	Kazekage.exe	97
PID 5568 wrote to memory of 2252	5568	Kazekage.exe	98
PID 5568 wrote to memory of 2252	5568	Kazekage.exe	98
PID 5568 wrote to memory of 2252	5568	Kazekage.exe	98
PID 2252 wrote to memory of 5864	2252	system32.exe	99
PID 2252 wrote to memory of 5864	2252	system32.exe	99
PID 2252 wrote to memory of 5864	2252	system32.exe	99
PID 2252 wrote to memory of 4736	2252	system32.exe	100
PID 2252 wrote to memory of 4736	2252	system32.exe	100
PID 2252 wrote to memory of 4736	2252	system32.exe	100
PID 2252 wrote to memory of 5108	2252	system32.exe	101
PID 2252 wrote to memory of 5108	2252	system32.exe	101
PID 2252 wrote to memory of 5108	2252	system32.exe	101
PID 2252 wrote to memory of 1140	2252	system32.exe	102
PID 2252 wrote to memory of 1140	2252	system32.exe	102
PID 2252 wrote to memory of 1140	2252	system32.exe	102
PID 2252 wrote to memory of 4412	2252	system32.exe	103
PID 2252 wrote to memory of 4412	2252	system32.exe	103
PID 2252 wrote to memory of 4412	2252	system32.exe	103
PID 4828 wrote to memory of 3576	4828	csrss.exe	104
PID 4828 wrote to memory of 3576	4828	csrss.exe	104
PID 4828 wrote to memory of 3576	4828	csrss.exe	104
PID 5972 wrote to memory of 780	5972	Gaara.exe	105

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe

C:\Users\Admin\AppData\Local\Temp\2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-03_c124d1c641c515d99194d553568f830a_black-basta_elex_hijackloader_luca-stealer.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2228
- C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
  "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4764
- - C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
    "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5244
- - C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
    "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Sets desktop wallpaper using registry
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5972
  - - C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
      "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5392
  - - C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
      "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4852
  - - C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
      "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      UAC bypass
      Disables RegEdit via registry modification
      Drops file in Drivers directory
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Drops file in System32 directory
      Sets desktop wallpaper using registry
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4828
    - - C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5672
    - - C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3612
    - - C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2424
    - - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops autorun.inf file
        Drops file in System32 directory
        Sets desktop wallpaper using registry
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5568
      - C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3468
      - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops autorun.inf file
        Drops file in System32 directory
        Sets desktop wallpaper using registry
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2252
        
        C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5864
        
        C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4736
        
        C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5108
        
        C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1140
        
        C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4412
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4268
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4212
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3260
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3716
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5168
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5340
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3284
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4396
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1108
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2040
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2444
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1916
    - - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3576
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3128
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3612
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4004
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2816
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5552
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:656
  - - C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:780
  - - C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:676
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5760
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5064
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5652
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:276
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1352
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1140
- - C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
    "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5528
- - C:\Windows\SysWOW64\drivers\Kazekage.exe
    C:\Windows\system32\drivers\Kazekage.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3064
- - C:\Windows\SysWOW64\drivers\system32.exe
    C:\Windows\system32\drivers\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1456
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1080
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3536
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1136
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5784
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3612
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1572
- C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
  "C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5260
- C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
  "C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3836
- C:\Windows\SysWOW64\drivers\Kazekage.exe
  C:\Windows\system32\drivers\Kazekage.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1376
- C:\Windows\SysWOW64\drivers\system32.exe
  C:\Windows\system32\drivers\system32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2052
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5372
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5668
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2052
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1780
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3420
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 3 - 5 - 2025\smss.exe
1⤵
PID:5784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 3 - 5 - 2025\Gaara.exe
1⤵
PID:5532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 3-5-2025.exe
1⤵
PID:3804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Anbu Team Sampit (Nothing).exe

Path C:\Admin Games\Anbu Team Sampit (Nothing).exe
Size 7.9MB
SHA256 bdc8002b0f6d2d371079fd7746024f3a8ea17035ce8a4325b2bc74db7d3ea071
MD5 fc383239c3b1831a3a749bfb3a20f3be
SHA1 806f3d1b88f57bd33e2b34522921d5e6dd1aa2b5
SHA512 4953d452d8286c312512ba2b921236afec67ba9220e6863f1c78dfc92240b43b46d8250b9b7733240c2f5115946b745af2c564e76bbc66b50623ecae6ce3d09e
SSDEEP 49152:MGyqWyWy0GyqWyWyMRPC1eHc785diLvQ8k:MGyqWyWy0GyqWyWyMRPC1eHL5dGYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Readme.txt

Path C:\Admin Games\Readme.txt
Size 736B
SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Autorun.inf
Size 196B
SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
MD5 1564dfe69ffed40950e5cb644e0894d1
SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
MD5 SHA1 SHA512

Submit Download

Gaara.exe

Path C:\Windows\Fonts\Admin 3 - 5 - 2025\Gaara.exe
Size 9.3MB
SHA256 189abc6c484d8b8dda6836d9150352d15c5dc26ece7d162898a60c187326e348
MD5 3791015d19b29c96684b3684c1a006d0
SHA1 ea984134d1a6683cc5b2578a44b4b2a2aaa8b909
SHA512 05671de49bb10154e62352a994600baf95ddbf70a758a498b756b48d3dc2fd901c4723df076701cac07040577455fc25a74f258ed55f542f077d87de3bfb27bd
SSDEEP 98304:uGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:z1eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
Size 9.3MB
SHA256 dcb98b03965b00384f03c8be98b99059aad75de53bbf7ef1fc24e954d566d221
MD5 c124d1c641c515d99194d553568f830a
SHA1 09b9ca6a96a6fff467b7bee404aa4a9edcb07ff9
SHA512 7e64603543b67bd665956446566eb1c517fba35ae5d34e59f861f17e0fed4f9caef3a22e38dee8efdcaf65981559f58cc1e474a088937de59b9648dfbb01c074
SSDEEP 98304:HGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:A1eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
Size 7.6MB
SHA256 3d31ee22300c4af76c717ebce9b758d94740a890e7d600a76e3164d523778d76
MD5 630976d9233c04da78c75a5085be9fb6
SHA1 9bf8c3811eb4175e07286aa8e95c688a3ab7da80
SHA512 6a2561cdcd49443fef29c363a690d567e1fa7b6d8ad18db60d68fa61c61aa04eb978ee5aaeb36a8b20496cacde61c60fab43c25fa78fb038ffad12277a52a627
SSDEEP 24576:MVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVGk:MGyqWyWy0GyqWyWyMRPC1eHc785diLvl
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 3 - 5 - 2025\csrss.exe
Size 9.3MB
SHA256 909d54fd6e3dff95c69114bb53cc2ffa71a98a10a005b9772f47d5c0f188095b
MD5 b9bb97cfa08f4bd256102e5635baa4b7
SHA1 1f0b5b12ce70e26c6bc51595898911796134be74
SHA512 5e27e8a9969c415cf25eefada932a8d5961ca6411d25b0d00114dfcf1d7d17b255fb9a40763e84192b4eb04916dd387c58401d3070bf6e449ac0634a7da43073
SSDEEP 98304:oGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:l1eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Windows\Fonts\Admin 3 - 5 - 2025\smss.exe
Size 9.3MB
SHA256 9f294d04fbae567852ce8eb3985ea943f42a381d394442dc14bcffd2fc05fd80
MD5 271eb8da4acfee8274ee37390efd4f71
SHA1 7bc70dc90e05954ee1442ecf09c467a836f64564
SHA512 c77d95cc53bd6bc8f4f5caa672f2c44a824354313ba111c6c247d4c7b5d1bfff6aeb609f0dbe755814c836d659ae991453eebded77e4e481c86ab3521933196f
SSDEEP 98304:MGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:J1eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

The Kazekage.jpg

Path C:\Windows\Fonts\The Kazekage.jpg
Size 1.4MB
SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
MD5 d6b05020d4a0ec2a3a8b687099e335df
SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

3-5-2025.exe

Path C:\Windows\SysWOW64\3-5-2025.exe
Size 704KB
SHA256 78edb84cc3d5d5a5e0abf853e717f62c63a0210b06730569be0c8b99d7e301a5
MD5 63cb12a7196864218f4075cb2fea63b7
SHA1 1e1392880fe0cd7aec6dca5c78519c4256c6e466
SHA512 c3640371729a58d4f89d87b5cde3871ee4f6f634e9709956c2586136491aabd450e4437be9df67aac36613593bae9a0c7f3d1dc84258d3e7b1c92720a95440cd
SSDEEP 12288:iVG84YqVG84YmVG84YeVG84Y6VG84Y2VG84YqVG84YWVG84YIVG84YqVG84YmVGP:iVG8gVG8UVG88VG8wVG8cVG8QVG8kVGW
MD5 SHA1 SHA512 SSDEEP

Submit Download

3-5-2025.exe

Path C:\Windows\SysWOW64\3-5-2025.exe
Size 9.3MB
SHA256 c9a1a4c596eb86a21a5053eacedeb40f6c814b9f58f799882bfb60cd7cf4ce5e
MD5 5aca5fa8420d95923d8f2f2305b58e0a
SHA1 1c4d77407c4d01ab332731262bff756af042b9ee
SHA512 4552ff0167796768de0ef938e92a5298ca40b85135dc63209c4f4f27f2a852a11b3f0b9ee987881f9680ccf186d78c8501fa3b41664131da180589a27bf16177
SSDEEP 98304:eGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:j1eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

3-5-2025.exe

Path C:\Windows\SysWOW64\3-5-2025.exe
Size 9.3MB
SHA256 32a1e1e44504c0383b50a0efb4905581b8c654586c39e913de5cf290f14438d3
MD5 22b07b816481e889f2fbabdb93bc9ff7
SHA1 b7e23c33e3e57adb2d8d5664d6b039e6c2a101d9
SHA512 b4c813f0f529b88c7dd3770436759ecde5c89fbc24aa90ecc49e3b34d5f6f615e253c5d691b4deaa7249eb66d02a12c7fd5da90b021e5bd030fe2118f408e6e9
SSDEEP 98304:nGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:g1eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

3-5-2025.exe

Path C:\Windows\SysWOW64\3-5-2025.exe
Size 9.2MB
SHA256 dca5b733062df07bdd7b3e8094d06ff6cb24b1fff83f251a28ff8bed356e74aa
MD5 3950798bab54ed7bd940c93f7605c257
SHA1 3010104fad5920983b34f7afaaaadd2936cf74e2
SHA512 e92471f1cdf6c22746b9c4a736748a56ce0a701412a832c75deab00232b267e72a0a35bf88d20bef6f2d875497dd5f9c730500ebe20800cfebc319ed272e8040
SSDEEP 98304:MGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYv0:J1eHL5dEv0
MD5 SHA1 SHA512 SSDEEP

Submit Download

3-5-2025.exe

Path C:\Windows\SysWOW64\3-5-2025.exe
Size 3.6MB
SHA256 ac535250179d60e07ed29772f6ffd11e8b26f006547692889eb79a9c803ae07c
MD5 76bbf7ae9deda7f5a646d888d74b76b5
SHA1 9f17ea95b9f59d0ab3eedd859a2172123c839dce
SHA512 911e82e33b6101a9998948cdbcf8b86734b7b0a3cfcda791debcd8aceb4119ee55ceb0f1a4884de073b5e7752104e945ac75198ee6056d6e10bedd80046437e2
SSDEEP 24576:uVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVGL:uGyqWyWy0GyqWyWyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

3-5-2025.exe

Path C:\Windows\SysWOW64\3-5-2025.exe
Size 3.6MB
SHA256 526000bca599c34a20f2b0b822af231c3cbcf09068f29933fbe192c404f6e07e
MD5 94dbb1091a00e9c5ff02e89c9d99cbd2
SHA1 34b943ed6b4e59d4a88f89a6db6d2db4720a8de2
SHA512 2d4f22a8ac2cd8bccb4e8bac498a83005ccb88e7faf7b5395c9cab2b02f7c4e348abc695892be5af04ac1905eb7d117b3b820f605fe60218724b3b9b25c9f8b2
SSDEEP 24576:aVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVGL:aGyqWyWy0GyqWyWyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Desktop.ini

Path C:\Windows\SysWOW64\Desktop.ini
Size 65B
SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
MD5 64acfa7e03b01f48294cf30d201a0026
SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
MD5 SHA1 SHA512

Submit Download

Kazekage.exe

Path C:\Windows\SysWOW64\drivers\Kazekage.exe
Size 9.3MB
SHA256 a8fe99add44e7fb3570af3c27b2d51cc1295a4927867a3f679c21a623ee3fc41
MD5 2bba270f664c27730448d0eb6d0de11a
SHA1 554f249797b90df6c8cb65b000f7f7fa86152f41
SHA512 582c0aeef412387bab8dc0e61c5127b5fa30fdc426030cfa1f755cc0c76456104ce72aed35bb699f4a0ff66bf12f0000c96ebf6ef143bca5aa964fb5642d29b0
SSDEEP 98304:GGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:71eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.3MB
SHA256 68f0b95a1eea6f5f6abedf8dfb522d0957d935f3a306f4d93e44f76e16ab8833
MD5 6fa76c52b89c8f1eec42b692f3592982
SHA1 54d07a4ef3617305c9e266d8c90e14ae73ca1e56
SHA512 01c71381b0cba1be095cc477e717e4975d6fa449774fa41c4e4a0e5f086f3023f1ca35c21cf391a76f7a1ee2908557d3601479818ad45ee671e7425b9524a599
SSDEEP 98304:SGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:H1eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.3MB
SHA256 3080982a1262b09b526ebfb34f2925cd386cb648e19c7f437805d68ae5f0c5b8
MD5 fed1125f1e1ffab6bbf0f9319c4d6208
SHA1 a0e83a4cf3beae99f5205dc0a240e81c98fb34a3
SHA512 c390f964a3711586d0e0aa196324cb77ef50dd6f581ca707fb0c58f79ca1f5d633b0d030299d9857040e45fbed041700ba428e9f988ec185b2432f2f3c49ebf9
SSDEEP 98304:iGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvL:X1eHL5dEvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\System\msvbvm60.dll
Size 1.4MB
SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
MD5 25f62c02619174b35851b0e0455b3d94
SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/676-266-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/780-262-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1140-249-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1376-292-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1456-281-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1592-213-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1668-204-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2052-296-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2228-297-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2228-315-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2228-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2228-162-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2252-217-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2252-270-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2252-569-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2252-302-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2424-166-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3064-274-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3576-258-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3612-161-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4412-254-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4736-242-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4764-33-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4764-170-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4764-298-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4764-401-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4828-235-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4828-506-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4828-300-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4828-124-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4852-119-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4852-115-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5244-75-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5244-70-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5260-285-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5568-301-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5568-250-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5568-171-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5568-579-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5972-77-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5972-448-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5972-299-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5972-205-0x0000000000400000-0x000000000042A000-memory.dmp

Download