Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 15:32
Static task
static1
General
-
Target
2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe
-
Size
435KB
-
MD5
926e84ab7cab9801a95e6467150ea839
-
SHA1
8221276d18b380f8e3d56b68b23b44248bb4d3c6
-
SHA256
2be5b56db72e4f911073af1911ecf4cf947f5aa66d75758443c12b33298d0aca
-
SHA512
2d249c7e85c73f40b08b2f08ba5577eb2798d72c441fa15da93314ab0c665fc144a1126796482ce89a78e116e0efe6a3ee47a737897b29bd9c16fe723579c586
-
SSDEEP
6144:/y9vGVBpyPgAZrDw6SZkMNpEa0X5wy5U+XQaZAOFBCwqwqwGlHntfwlaR48:kGVBpSZrDw6SZkMNp1rMQGrBuNon8
Malware Config
Extracted
phorphiex
http://185.156.72.39/
http://45.141.233.6/
TW3wpRJmZgC5WifuY468JBUCF3TEkzBT5H
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MF6iVGLmErYP9y4B9SwtzarDoy3ETSzYrh
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
0x46e5cc402BC848ceC9f4d65c9B48aE7D7A24821B
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1B8FF5WwJXNnjkVzxgPkAznVZ8uKb3Watx
ltc1qyfzdpxky7q2grz4zmqv5x0t0uwfuznl5u43c93
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3GcQJkfHq7NWgBhhNKjz7uSfM6LzADpLvX
CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1q9tgkga69k094n5v0pn7ewmpp2kn66sh9hu65gq
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
l9n7b5f2r
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral1/files/0x000b00000002402a-10.dat family_phorphiex -
Downloads MZ/PE file 2 IoCs
flow pid Process 37 4700 4C8A.exe 2 2356 2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe -
Executes dropped EXE 4 IoCs
pid Process 4700 4C8A.exe 432 1121332726.exe 1120 syscrondvr.exe 5288 syscrondvr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syscrondvr.exe" 1121332726.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\syscrondvr.exe 1121332726.exe File created C:\Windows\syscrondvr.exe 1121332726.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C8A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1121332726.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syscrondvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4700 2356 2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe 90 PID 2356 wrote to memory of 4700 2356 2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe 90 PID 2356 wrote to memory of 4700 2356 2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe 90 PID 4700 wrote to memory of 432 4700 4C8A.exe 100 PID 4700 wrote to memory of 432 4700 4C8A.exe 100 PID 4700 wrote to memory of 432 4700 4C8A.exe 100 PID 432 wrote to memory of 1120 432 1121332726.exe 102 PID 432 wrote to memory of 1120 432 1121332726.exe 102 PID 432 wrote to memory of 1120 432 1121332726.exe 102 PID 1160 wrote to memory of 5288 1160 cmd.exe 104 PID 1160 wrote to memory of 5288 1160 cmd.exe 104 PID 1160 wrote to memory of 5288 1160 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\4C8A.exe"C:\Users\Admin\AppData\Local\Temp\4C8A.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\1121332726.exeC:\Users\Admin\AppData\Local\Temp\1121332726.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\syscrondvr.exeC:\Windows\syscrondvr.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1120
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\syscrondvr.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\syscrondvr.exeC:\Windows\syscrondvr.exe2⤵
- Executes dropped EXE
PID:5288
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5f30fdbf3448f67cbc3566f31729cb7a6
SHA1fbf005c38f4a1c2e86817a2cb70406fc241f2c90
SHA25681783b558904becc5b86553faba9525070de5f43339766eb1c025bcfbfe1eef8
SHA512b428df2c8f8b4a002c8d7e1bfd9926e5cf95ee998688a2c360b8551e80be5bfbfa17ef210bea35f247da4a5c8a940fb5dba49f4786da9a74e5d001b771c8e9a8
-
Filesize
10KB
MD50ec46393976eb51f307cc11d80bae845
SHA169d4cb168f3a1b97c37a0ba1519d0adb1ff7e245
SHA256252171bdaa35d19f872c165e861b03d347a4afb85d7a03d02f8eae09d191038d
SHA512803351760e3c422e4825103235e13085004b3418b483a2c646aafaef62b7212a1ba4ed28469134a236c5b6121e6a748ba958bbae2dbe4afe9f9f45704928d31f