Malware Analysis Report

2025-06-16 05:39

Sample ID 250520-ked45swq14
Target 2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer
SHA256 82b33a1aca5648e9b5ce944920cf3be5f5f9dac2c913d68a66d6d55240fc0606
Tags
mofksys defense_evasion discovery persistence worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82b33a1aca5648e9b5ce944920cf3be5f5f9dac2c913d68a66d6d55240fc0606

Threat Level: Known bad

The file 2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer was found to be: Known bad.

Malicious Activity Summary

mofksys defense_evasion discovery persistence worm

Modifies visiblity of hidden/system files in Explorer

Detects Mofksys worm

Mofksys family

Modifies WinLogon for persistence

Mofksys

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-20 08:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-20 08:30

Reported

2025-05-20 08:33

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe"

Signatures

Detects Mofksys worm

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Mofksys

worm mofksys

Mofksys family

mofksys

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3168 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe \??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 
PID 3168 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe \??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 
PID 3168 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe \??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 
PID 3168 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 3168 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 3168 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 2572 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2572 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2572 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2988 wrote to memory of 3692 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2988 wrote to memory of 3692 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2988 wrote to memory of 3692 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3692 wrote to memory of 1900 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 3692 wrote to memory of 1900 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 3692 wrote to memory of 1900 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1900 wrote to memory of 4064 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1900 wrote to memory of 4064 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1900 wrote to memory of 4064 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1900 wrote to memory of 4864 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1900 wrote to memory of 4864 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1900 wrote to memory of 4864 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 728 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\explorer.exe
PID 728 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\explorer.exe
PID 728 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\explorer.exe
PID 1988 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\svchost.exe
PID 1988 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\svchost.exe
PID 1988 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\svchost.exe
PID 1900 wrote to memory of 4148 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1900 wrote to memory of 4148 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1900 wrote to memory of 4148 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1900 wrote to memory of 4928 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1900 wrote to memory of 4928 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1900 wrote to memory of 4928 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe"

\??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 

c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 

C:\Users\Admin\AppData\Local\icsys.icn.exe

C:\Users\Admin\AppData\Local\icsys.icn.exe

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\system\explorer.exe RO

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\system\svchost.exe RO

C:\Windows\SysWOW64\at.exe

at 08:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe RO

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe RO

C:\Windows\SysWOW64\at.exe

at 08:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 08:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
GB 2.18.27.89:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp

Files

C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 

MD5 f8d95eb8c84c6de968a90496256180b1
SHA1 52ec2c2d0dfb4e0ee4cacf58c06308673caf7535
SHA256 d0fbb98b3de71b571276016743d1a2b56fc71b8708455a533a7489fdb64e63de
SHA512 0b2a33093ecab5307c496283bec5d8fcd40a53921b7f73ea643c2b43c712c6264337fc16f340c9021fa17f45a02e888c19b4d2a244f970376720416bbbfb883e

C:\Users\Admin\AppData\Local\Temp\log.txt

MD5 0f44db32cf6f469e3357f4e033385c8d
SHA1 38c1bc1cd2e0c66721166ec7b40cf8c2dca88d68
SHA256 6b81b8d5583c1be487f5fcbcfd0c5ae6458d13606ae987422e3cf0cb3ef41bfa
SHA512 41edc7343c20e945f1f3554631615718333e4365cd56ea9a71b1ba0c71bd1b43f4a9e408b06bf581f72907bd333b6cff8595b0ccd00680461b523d615d0cb3ee

C:\Users\Admin\AppData\Local\icsys.icn.exe

MD5 e9a8033ab8de7db2b2e38a4660d28c0f
SHA1 4c19b54a5867cf510713290629d694e89ed1a577
SHA256 5501e7f08d4d015d7aa2bba6182714d67bc53cc303356db9ce1e296c8216d136
SHA512 24c18dbca8e9685e65be88a312fc6fdfaa98b2f19833bcc90344682b7825c88b62295f02c5efa890b80266f6675cfcd54150d17af014ef75be1b6a8baa1bbdff

C:\Windows\System\explorer.exe

MD5 14f2382c70673bd4d278d3822291cdd1
SHA1 b4c2643c5ada1f7ec578a9967a8ca6adae84a03d
SHA256 d913e023fba5aa8b7951afe9f4157b495ef5046da79e267fa2560dd23066fcb6
SHA512 814e757c7e043671a91bb84e73790f1705e1b1632418b47b25881e97a3880b313fae2c7c2a2d7db6101012bb50364c759397f3062f806aa510fc52f7e9f0e863

C:\Windows\System\spoolsv.exe

MD5 00c8a166b13f73f380a9f6344adf6318
SHA1 5fec53f42d797519c67c7b9d35b311c43c2d35f1
SHA256 6d712a4d4a5e32f14eb1b98d7149706d1dd92955c4390dc54e06fcd06635c0cc
SHA512 aed3000a0c64dbc3a0a33d6adba318f3c72ef50889b19cb743bbb36bf033f850d1223a27715b2bb05c0fe59ad74375097605505c21b91563b4856097fa23d6a0

C:\Windows\System\svchost.exe

MD5 b5df5e0f1a0f2ade0f19bc987f617901
SHA1 cea5d3fa34e0b3e41532e687c08ca8450f70f04b
SHA256 841008a800929cfeafe4e3f7957ddfaa759eaf210d28d3c9d6b866ac91a82408
SHA512 4b07fa2a0c2e7c695cd2ee18dd564446cf83aaa09bd54745da76adb8baaa2f1e86c334e0ec73fd8c710da0a4a344397b80bfbd0a47954111e293aa75fda1f829

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 fbb8f368c8434f7fa1f5bdf1ba9a4668
SHA1 ba84254715facf05613af9c62a6c0e233166a536
SHA256 ded61d57c823645096db937464223506863c7546905d5a0bcccc919dfbe2bf78
SHA512 4004bc774fb4cd99bd1bf0a81bc22f92be1e0b59c5d0f50a0b27ff166c04c99337cdb9e941b32ebc2a5e9b2887db5a54d5a2160aeda958127f4052fe28f892cd

Analysis: behavioral2

Detonation Overview

Submitted

2025-05-20 08:30

Reported

2025-05-20 08:33

Platform

win11-20250502-en

Max time kernel

150s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe"

Signatures

Detects Mofksys worm

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-434880884-4028056734-3558218839-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-434880884-4028056734-3558218839-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Mofksys

worm mofksys

Mofksys family

mofksys

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5716 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe \??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 
PID 5716 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe \??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 
PID 5716 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe \??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 
PID 5716 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 5716 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 5716 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 5116 wrote to memory of 5864 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 5116 wrote to memory of 5864 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 5116 wrote to memory of 5864 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 5864 wrote to memory of 5984 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 5864 wrote to memory of 5984 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 5864 wrote to memory of 5984 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 5984 wrote to memory of 4700 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 5984 wrote to memory of 4700 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 5984 wrote to memory of 4700 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4700 wrote to memory of 4956 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 4700 wrote to memory of 4956 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 4700 wrote to memory of 4956 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 4700 wrote to memory of 4916 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4700 wrote to memory of 4916 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4700 wrote to memory of 4916 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5040 wrote to memory of 3516 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\explorer.exe
PID 5040 wrote to memory of 3516 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\explorer.exe
PID 5040 wrote to memory of 3516 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\explorer.exe
PID 5052 wrote to memory of 3768 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\svchost.exe
PID 5052 wrote to memory of 3768 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\svchost.exe
PID 5052 wrote to memory of 3768 N/A C:\Windows\system32\cmd.exe \??\c:\windows\system\svchost.exe
PID 4700 wrote to memory of 3248 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4700 wrote to memory of 3248 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4700 wrote to memory of 3248 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4700 wrote to memory of 2764 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4700 wrote to memory of 2764 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4700 wrote to memory of 2764 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe"

\??\c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 

c:\users\admin\appdata\local\temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 

C:\Users\Admin\AppData\Local\icsys.icn.exe

C:\Users\Admin\AppData\Local\icsys.icn.exe

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\system\explorer.exe RO

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\system\svchost.exe RO

C:\Windows\SysWOW64\at.exe

at 08:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe RO

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe RO

C:\Windows\SysWOW64\at.exe

at 08:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 08:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Files

C:\Users\Admin\AppData\Local\Temp\2025-05-20_a6706faee9b596ab1003002d11892d3a_black-basta_cobalt-strike_elex_luca-stealer.exe 

MD5 f8d95eb8c84c6de968a90496256180b1
SHA1 52ec2c2d0dfb4e0ee4cacf58c06308673caf7535
SHA256 d0fbb98b3de71b571276016743d1a2b56fc71b8708455a533a7489fdb64e63de
SHA512 0b2a33093ecab5307c496283bec5d8fcd40a53921b7f73ea643c2b43c712c6264337fc16f340c9021fa17f45a02e888c19b4d2a244f970376720416bbbfb883e

C:\Users\Admin\AppData\Local\Temp\log.txt

MD5 2f17afdac3b6b12d045459de51bf23bf
SHA1 9833b18ad03775c8e0bfdd02edf070304da993f0
SHA256 84ad491dac9b752ecdd49ebdf0c616e7da8a404afb69979cccd27ce1fde0294d
SHA512 7a43abcffbb1f5ab7f69eb3b927c87973f271b4b9d999389cb20a1ec2388ad5c70ff0256ea2c9c42b8be27156e65b6ae2b1b4cfa197558d489a22ea137abc566

C:\Users\Admin\AppData\Local\icsys.icn.exe

MD5 e9a8033ab8de7db2b2e38a4660d28c0f
SHA1 4c19b54a5867cf510713290629d694e89ed1a577
SHA256 5501e7f08d4d015d7aa2bba6182714d67bc53cc303356db9ce1e296c8216d136
SHA512 24c18dbca8e9685e65be88a312fc6fdfaa98b2f19833bcc90344682b7825c88b62295f02c5efa890b80266f6675cfcd54150d17af014ef75be1b6a8baa1bbdff

\??\c:\windows\system\explorer.exe

MD5 a9bd66f61f245d64dcbf1f11c20e4ea5
SHA1 5ef556521730cbb1dfb91be4546deee1cdbc43ca
SHA256 bfa43ec06fe362903dfe9cf069eaa373641002565dbf76cd1dbed21f1b3e5962
SHA512 f20ea78481e66c571abfc93509d4d3603f94bb1c1de39f80852c14a49bf176364c205c7b29e6658b55812658bbb3e26f9874618377181cd06420fca9e31ca0c6

C:\Windows\System\spoolsv.exe

MD5 fe5eebc29761e754cdaf703b2ad357f7
SHA1 3216f408c4cf825a5864bf31c284722b8ff8a5dd
SHA256 cb5f93a42663b918b8701c0c381d53e334013170fc27b9e36bdbaf3fe1014885
SHA512 c7ce981dc7621de0f58e50399d3cf7d84ef091025fa029e8a3d37ac16e48b04e8daf023e86bb55c6c0ea2780ab560b9891980dd8925c47cc0960b8dd0b758cb4

C:\Windows\System\svchost.exe

MD5 52ed03044ce375edd527560cb0bcd48b
SHA1 31aa3afc8cf077dba701de0324d29e6fe6b8fa5f
SHA256 f3b34320a32110653b0986fc71f6f593824018289a402ac7e7aaf438ec511d7f
SHA512 e8f6164c7f6e1fa5130ef6545d3ad166091f240b2a1f640ba0666e55407e3895687034a8ce172c406f3a459292c522c34636fd6924d90834ecc192d115c6b135

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 21e4a53dceb8b4d98163d6730cbdb46b
SHA1 bff408f2da489b9a4a42e010a5fe0ec29fa1d283
SHA256 72985246023aaebea36e14491ea8b4e25a4148d978efad60a1773131383f3763
SHA512 4e644815a9e9a14e9bae4087d41b8e7e9d2ca28f61784fb2dcbd63ebbd8f141409e6c22ced62672e424bf33fdbe9930d1ce65ba22cd2bf4199ef536e50d1f859