8f793222d7360ce526b8ad4d769375008e89aa4e4302d13f880a5e83bc435037

Analysis

max time kernel
100s
max time network
111s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
16/05/2025, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-05-16_af7c83d714f58aa6041a25c8dc610002_black-basta_elex.exe
Size 7.8MB
Sample250516-lt7wfa1va1
SHA256 8f793222d7360ce526b8ad4d769375008e89aa4e4302d13f880a5e83bc435037
MD5 af7c83d714f58aa6041a25c8dc610002
SHA1 b260aa27686dfb923693fc657b08f0e80ff84ff8
SHA512 ac02cdad6bdd1d861abca72f5d465c45fc7ad2ab4d0ec438a38d4470a57faff82c677831c766b6474befd9727adef5a185fb3914fce785ba748c4092f59171db
SSDEEP 98304:S0nAAYEpuhtu1MbQ9yDAD7KjjqkusjmqMh0:XNWu1tIDewjqkjiqMm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2180	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-16_af7c83d714f58aa6041a25c8dc610002_black-basta_elex.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 2180	5796	2025-05-16_af7c83d714f58aa6041a25c8dc610002_black-basta_elex.exe	80
PID 5796 wrote to memory of 2180	5796	2025-05-16_af7c83d714f58aa6041a25c8dc610002_black-basta_elex.exe	80

C:\Users\Admin\AppData\Local\Temp\2025-05-16_af7c83d714f58aa6041a25c8dc610002_black-basta_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-16_af7c83d714f58aa6041a25c8dc610002_black-basta_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 1686a4b5092c3d132d5af71950cdb17990466958ac7112a1ae8bb807e781e2f8
MD5 d71716862694ebab7f5842a923b594a2
SHA1 025143dc711f26e328032485bae035dc26a370b1
SHA512 23b6cd359195fd8d6fcbf585ae5e1d3eaa95ae4bad3668bdf5995f74ba0c7ddf177df1c715b881a81c6e0418434ba6b440c58fb23991b0155257dd3040727ea6
SSDEEP 24576:E7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOLh1YA+w7anMYenGJiKEbX+:n6F0eMpAAYEhpQQhwmMPnRWt44
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX9412.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX9412.tmp
Size 1.2MB
SHA256 285a70a24959325f134df1edc97b8e06d4eed84f44d72a8a1d48e7a846bafcb8
MD5 b9693463e987a3bb905954dfc20dd398
SHA1 578f6800d243273b42d2bd7e298fa385763f9de3
SHA512 bc6e2fcd4f256a71d283b456cb2b72c5c7b141e334ee4c9d23e26da30e44b4f352d63f623d5cd2422d441cd8c27158d200ed918d7b5755b006e6e9dbe596a722
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+h1YA+wmP:j6F0eMpAAYEhpxQhwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX97CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX97CE.tmp
Size 1.2MB
SHA256 5c0536f1df8cc40dd159e808b1c2d242970ada10bf294f7f940ef59d52baaf18
MD5 140665a489aa6421c7037660b21ec2b3
SHA1 c18f99ea4fed18f5e25245ac3658621c2c5b2fca
SHA512 9eb31f4d6a00db6c09e003e7ada171948b63ddf92e4c562ade8e0f0a168fa2c472faf5b9d7d4b32fe6d8f259e42cdada2f048fb182454ff443b35507e1c861f5
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOUh1YA+w7C:/6F0eMpAAYEhpnQhwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX988E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX988E.tmp
Size 1.2MB
SHA256 345822fc9e3f0170a3b6cdec3c9bda394cd71b215ed5864b728aa86ea1844660
MD5 adb06853f255a089fe4a9e4cddf9129f
SHA1 4bc752074abd57a7e625aed6470a8f3492c00988
SHA512 c240eddf6acec92e27d01f3a0905e88a89f6669a786cf50ab42ada95bfec2064c284b7fcd1acac9296856bf628c23bb443ad415f4c1346a9c4184450d8ceb887
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORh1YA+wmX:H6F0eMpAAYEhpeQhwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
MD5 SHA1 SHA512 SSDEEP

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 356f70f980a0abf69dc12dd9aec7f8f3da1843a7bbf50c2f29e9cda99e593a03
MD5 284e946d27903191d6fcfac933b10766
SHA1 b4e83c8387696cf2ea0409c63e33eabc210cf9d3
SHA512 62bba46c98019c58951a57ce7ad1847c0007a6bce32f9c37ca4f3a62a149980aea3e56932fb46a5887ca5d29bf29e5713b7960af723aa80f02e15f8db136a695
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO+h1YA+w/e:z6F0eMpAAYEhpBQhwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 b2a31f649cc0defc3fb04ba7c6616c1bbb3def8824175e3bb6c14176182b221a
MD5 c55f4fe90b4f875b21039f0b8b131a35
SHA1 6f78c2078b3ddf2387435eff8a7a9cdd189bb375
SHA512 c5b7602235e3981bfd068bb9431cad57482c85f91b045179fb548f0b1ce5bf96a97981790be2f874cecec48d4487daede3f70bcab645024b9b05abd79cac054f
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO3h1YA+wKo:j6F0eMpAAYEhp8QhwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 4679d72cb4bb80b3d9c8250adec09e422a5199f375c0fd874f3e4ebb382a3df2
MD5 5e0d70bfd2f81f3803361ff57731da07
SHA1 efc5250868fde54c9f84777bb7a0c0e1d2382c21
SHA512 58e99c03fdafcc575ec276b99cd2696c726dc005e995230e27944935ad5bf983a09fb8e9f7c1f81a0178fb7c5287a610ddd288b99f2c6c29ed462bc2e0ffa84c
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOxh1YA+wo7:/6F0eMpAAYEhpmQhwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5796-356-0x0000000000400000-0x0000000000534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads