7c80a66dcccb20940daf67da3b499a0664da5b74ad537887b4a7a06fccfa6c01

General

Target
2025-05-16_8f7446d8950b4020a18a2fbdc9212e10_black-basta_elex.exe
Size 7.8MB
Sample250516-lrw16asmw3
SHA256 7c80a66dcccb20940daf67da3b499a0664da5b74ad537887b4a7a06fccfa6c01
MD5 8f7446d8950b4020a18a2fbdc9212e10
SHA1 fee05cfec1c6d8f2266ad7392df4755f25dbd087
SHA512 e7a7150b452a2f7429666af9011544c7c7a20d75ff5fd6bbf4922b298d786e1a70f619ad32c3e22a42ddcb2a9a4d211d5e4bcbc037e8df0ee717020bac6b46e7
SSDEEP 98304:X0nAAYEpQh6u1MbQ9yDAD7KjjqkusjmqMhI:ENru1tIDewjqkjiqMC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2232	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-16_8f7446d8950b4020a18a2fbdc9212e10_black-basta_elex.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2232	5028	2025-05-16_8f7446d8950b4020a18a2fbdc9212e10_black-basta_elex.exe	79
PID 5028 wrote to memory of 2232	5028	2025-05-16_8f7446d8950b4020a18a2fbdc9212e10_black-basta_elex.exe	79

C:\Users\Admin\AppData\Local\Temp\2025-05-16_8f7446d8950b4020a18a2fbdc9212e10_black-basta_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-16_8f7446d8950b4020a18a2fbdc9212e10_black-basta_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 9f63c30937dad6e47f3e2407ad4ad4e67697f181dbc98676a0918d62887a2a70
MD5 e01d21eb9429a6d369168857d0d71f58
SHA1 fd802c23c0007083cc48dc7cdfead70b34be8932
SHA512 f3c0df0e658de13d4a017b0ac2b99396c953bac462f1312169ec7d822c968d01be162df718ecd40d11cb677eb5e7a82d89e5f9d5004f6f8bd0ecb2773e509f71
SSDEEP 24576:77VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOUYA+wtQnMYenGJiKEbXWtP:Y6F0eMpAAYEhpChwSMPnRWt4a
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 535e0d1ef381a6e06ff01122442b422756f823ef555eda3756421a256a854144
MD5 01abba60075adfb6f96836c215db267f
SHA1 65c576aebe17be6ac92a87d6bd9b070c0a2ee84f
SHA512 133a755d4f98adabc050c145965aac4e5cb2f1dd7b53eb55e37ea169827e18b6e617447b9fbb168736419e3a610da90ee65d34964477448e6536ca6e3fce545d
SSDEEP 24576:N7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOkq5qRs47WXnueVulvspdbb:G6F0eMpAAYEhpVq437WXnu6ulvKdfLMg
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCXA5D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXA5D5.tmp
Size 1.2MB
SHA256 65e404fafac449bfd74c86c3a4e8b4f428864a8fb9bb27069fd65a3cc1061f42
MD5 2b7c7d8301aa22397d36d725e6817ff8
SHA1 f542f83c04013d0bf500aa06c9c76207c3202719
SHA512 d4468f39c5f036b7e9345563110508f068a5574abd2d23167be8ea3288c1ec5fa0c01a310f3d04105e7ca4f9e354896311b29334a07d59fe604339660b7a9b2e
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpgYA+w46:86F0eMpAAYEhpSRhwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCXA827.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXA827.tmp
Size 1.2MB
SHA256 794fa4cb2ac27862a2eee5544feffe284f9462f18ecc426c129828c3bd538324
MD5 74f879ac870e62b7d5b5ed08e164f56e
SHA1 02bc53439c8af5718b7afa8a1315402c8a2bc886
SHA512 9afeb6e4c73369b37e8ecdaf27106224b7c413afef5007bbb39459f10edcf02b55b085d1fb3406655a1abf2ce10777911cfcd0e79e1d15b37291e9393f1bc7de
SSDEEP 24576:/7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOygYA+wtG:E6F0eMpAAYEhpVRhwQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCXA926.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXA926.tmp
Size 1.1MB
SHA256 b2228aba09f01368e7fd952ff141e879d37594b5919eeab809a20485b5b6e438
MD5 efdb7836a4d9c772584e07fb41da408e
SHA1 0e3102eeeb8048387540be9e1256df7c1e659348
SHA512 f3064d83e03ccecb9674d09033b0189fad2ef92a14f9848b103a917118dc27cf3baf69b636aa900d7b80f68e05a6194750f668d5eb980c4ad507513a7de3aa81
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrYA+w4F:A6F0eMpAAYEhpPhwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5028-333-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads