Analysis
- max time kernel
149s - max time network
134s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
22/05/2025, 12:43
Behavioral task
behavioral1
Sample
2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe
Resource
win11-20250502-en
windows11-21h2-x64
29 signatures
150 seconds
General
- Target 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe
- Size 9.4MB
- Sample250522-pyb64stmt7
- SHA256 962ea01c16b8ec2a63e873eff76193e0dc2e63fb2f94621be9237a5f2ac5008a
- MD5 a398ec442b3dcb1883a0f260a9c5f681
- SHA1 71e480765f473a39f0a5e063a7f60eed13eb1b05
- SHA512 d060fa060f4571643e264ee0da02e7bf233f094389f5e46ca7470aa090586bfc9a028940b3ecbcf5906133db8da8d3432c3cd83ca43432f59ec806832b06098f
- SSDEEP 98304:nGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:g1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe" Kazekage.exe - Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" system32.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe - UAC bypass 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kazekage.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Gaara.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe system32.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe smss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe csrss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Kazekage.exe File created C:\Windows\SysWOW64\drivers\system32.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe system32.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File created C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\system32.exe csrss.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe smss.exe File opened for modification C:\Windows\SysWOW64\drivers\Kazekage.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\drivers\system32.exe Gaara.exe File created C:\Windows\SysWOW64\drivers\Kazekage.exe Kazekage.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe csrss.exe - Executes dropped EXE 30 IoCs
pid Process 5636 smss.exe 5656 smss.exe 5228 Gaara.exe 5096 smss.exe 5032 Gaara.exe 4704 csrss.exe 3892 smss.exe 784 Gaara.exe 4856 csrss.exe 5692 Kazekage.exe 4896 Gaara.exe 5368 smss.exe 1096 csrss.exe 4876 Kazekage.exe 5480 Gaara.exe 2488 csrss.exe 1144 system32.exe 2240 Kazekage.exe 3124 system32.exe 1664 smss.exe 2936 system32.exe 1848 Gaara.exe 3544 csrss.exe 2160 Kazekage.exe 2004 Kazekage.exe 5616 system32.exe 5380 csrss.exe 5460 system32.exe 4372 Kazekage.exe 248 system32.exe - Loads dropped DLL 18 IoCs
pid Process 5636 smss.exe 5656 smss.exe 5228 Gaara.exe 5096 smss.exe 5032 Gaara.exe 4704 csrss.exe 3892 smss.exe 784 Gaara.exe 4856 csrss.exe 4896 Gaara.exe 5368 smss.exe 1096 csrss.exe 5480 Gaara.exe 2488 csrss.exe 1664 smss.exe 1848 Gaara.exe 3544 csrss.exe 5380 csrss.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 22 - 5 - 2025\\Gaara.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 22 - 5 - 2025\\smss.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 22 - 5 - 2025\\smss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "22-5-2025.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 22 - 5 - 2025\\Gaara.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "22-5-2025.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 22 - 5 - 2025\\Gaara.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "22-5-2025.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "22-5-2025.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "22-5-2025.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 22 - 5 - 2025\\smss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 22 - 5 - 2025\\smss.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 22 - 5 - 2025\\Gaara.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 22 - 5 - 2025\\smss.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 22 - 5 - 2025\\Gaara.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "22-5-2025.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 22 - 5 - 2025\\Gaara.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 22 - 5 - 2025\\smss.exe" system32.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification \??\P:\Desktop.ini Gaara.exe File opened for modification \??\U:\Desktop.ini Gaara.exe File opened for modification \??\A:\Desktop.ini smss.exe File opened for modification \??\M:\Desktop.ini smss.exe File opened for modification \??\W:\Desktop.ini smss.exe File opened for modification \??\U:\Desktop.ini system32.exe File opened for modification \??\V:\Desktop.ini Kazekage.exe File opened for modification \??\L:\Desktop.ini system32.exe File opened for modification \??\E:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\Y:\Desktop.ini system32.exe File opened for modification D:\Desktop.ini csrss.exe File opened for modification \??\J:\Desktop.ini csrss.exe File opened for modification \??\T:\Desktop.ini csrss.exe File opened for modification \??\G:\Desktop.ini system32.exe File opened for modification \??\H:\Desktop.ini Gaara.exe File opened for modification \??\M:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\N:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\S:\Desktop.ini Gaara.exe File opened for modification \??\V:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\X:\Desktop.ini csrss.exe File opened for modification \??\J:\Desktop.ini system32.exe File opened for modification \??\R:\Desktop.ini Gaara.exe File opened for modification \??\X:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\A:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\K:\Desktop.ini smss.exe File opened for modification \??\S:\Desktop.ini csrss.exe File opened for modification \??\S:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini system32.exe File opened for modification \??\A:\Desktop.ini Kazekage.exe File opened for modification \??\B:\Desktop.ini Kazekage.exe File opened for modification C:\Desktop.ini csrss.exe File opened for modification \??\O:\Desktop.ini smss.exe File opened for modification \??\B:\Desktop.ini Gaara.exe File opened for modification D:\Desktop.ini Gaara.exe File opened for modification \??\I:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\T:\Desktop.ini Gaara.exe File opened for modification \??\V:\Desktop.ini Gaara.exe File opened for modification \??\E:\Desktop.ini csrss.exe File opened for modification \??\I:\Desktop.ini csrss.exe File opened for modification D:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\V:\Desktop.ini system32.exe File opened for modification \??\Q:\Desktop.ini Gaara.exe File opened for modification \??\Q:\Desktop.ini Kazekage.exe File opened for modification \??\O:\Desktop.ini system32.exe File opened for modification F:\Desktop.ini Gaara.exe File opened for modification \??\S:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\Y:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\L:\Desktop.ini smss.exe File opened for modification \??\P:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini smss.exe File opened for modification \??\O:\Desktop.ini Kazekage.exe File opened for modification \??\W:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\Y:\Desktop.ini Gaara.exe File opened for modification \??\Z:\Desktop.ini Gaara.exe File opened for modification \??\Y:\Desktop.ini csrss.exe File opened for modification \??\Z:\Desktop.ini smss.exe File opened for modification \??\R:\Desktop.ini Kazekage.exe File opened for modification D:\Desktop.ini system32.exe File opened for modification F:\Desktop.ini system32.exe File opened for modification \??\H:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\J:\Desktop.ini Gaara.exe File opened for modification \??\T:\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification \??\G:\Desktop.ini csrss.exe File opened for modification \??\P:\Desktop.ini csrss.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Kazekage.exe File opened (read-only) \??\W: Kazekage.exe File opened (read-only) \??\B: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\Z: system32.exe File opened (read-only) \??\K: Gaara.exe File opened (read-only) \??\L: Kazekage.exe File opened (read-only) \??\B: system32.exe File opened (read-only) \??\X: system32.exe File opened (read-only) \??\N: Gaara.exe File opened (read-only) \??\T: Gaara.exe File opened (read-only) \??\Q: Kazekage.exe File opened (read-only) \??\H: system32.exe File opened (read-only) \??\L: system32.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\G: Kazekage.exe File opened (read-only) \??\I: Kazekage.exe File opened (read-only) \??\A: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\H: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\J: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\J: csrss.exe File opened (read-only) \??\P: Kazekage.exe File opened (read-only) \??\T: Kazekage.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\O: Kazekage.exe File opened (read-only) \??\G: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\A: smss.exe File opened (read-only) \??\M: Kazekage.exe File opened (read-only) \??\E: Gaara.exe File opened (read-only) \??\V: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\B: smss.exe File opened (read-only) \??\Z: smss.exe File opened (read-only) \??\Q: Gaara.exe File opened (read-only) \??\R: Gaara.exe File opened (read-only) \??\Z: Gaara.exe File opened (read-only) \??\E: smss.exe File opened (read-only) \??\A: csrss.exe File opened (read-only) \??\L: smss.exe File opened (read-only) \??\V: csrss.exe File opened (read-only) \??\W: smss.exe File opened (read-only) \??\Z: Kazekage.exe File opened (read-only) \??\G: Gaara.exe File opened (read-only) \??\Z: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\B: csrss.exe File opened (read-only) \??\U: smss.exe File opened (read-only) \??\X: smss.exe File opened (read-only) \??\U: Kazekage.exe File opened (read-only) \??\K: system32.exe File opened (read-only) \??\R: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\Y: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\P: smss.exe File opened (read-only) \??\X: csrss.exe File opened (read-only) \??\A: Gaara.exe File opened (read-only) \??\P: system32.exe File opened (read-only) \??\R: system32.exe File opened (read-only) \??\H: Gaara.exe File opened (read-only) \??\M: Gaara.exe File opened (read-only) \??\X: Gaara.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\E: Kazekage.exe File opened (read-only) \??\L: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\M: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\W: 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened (read-only) \??\H: smss.exe - Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\R:\Autorun.inf smss.exe File opened for modification \??\W:\Autorun.inf csrss.exe File created \??\B:\Autorun.inf Kazekage.exe File created \??\I:\Autorun.inf system32.exe File opened for modification \??\B:\Autorun.inf Gaara.exe File created \??\R:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf Kazekage.exe File created \??\U:\Autorun.inf system32.exe File opened for modification \??\R:\Autorun.inf 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created \??\S:\Autorun.inf smss.exe File created \??\O:\Autorun.inf Kazekage.exe File opened for modification C:\Autorun.inf system32.exe File opened for modification \??\V:\Autorun.inf 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification F:\Autorun.inf smss.exe File created \??\I:\Autorun.inf smss.exe File created \??\L:\Autorun.inf smss.exe File opened for modification \??\O:\Autorun.inf Gaara.exe File opened for modification \??\R:\Autorun.inf Gaara.exe File created \??\I:\Autorun.inf csrss.exe File opened for modification \??\R:\Autorun.inf csrss.exe File created \??\W:\Autorun.inf csrss.exe File created \??\A:\Autorun.inf Kazekage.exe File created \??\R:\Autorun.inf Kazekage.exe File created \??\B:\Autorun.inf smss.exe File created \??\S:\Autorun.inf csrss.exe File created D:\Autorun.inf Gaara.exe File opened for modification \??\U:\Autorun.inf Gaara.exe File opened for modification \??\I:\Autorun.inf Kazekage.exe File opened for modification \??\P:\Autorun.inf system32.exe File opened for modification \??\X:\Autorun.inf system32.exe File created \??\O:\Autorun.inf smss.exe File created \??\L:\Autorun.inf csrss.exe File created \??\V:\Autorun.inf csrss.exe File opened for modification \??\T:\Autorun.inf Kazekage.exe File opened for modification \??\I:\Autorun.inf system32.exe File created \??\W:\Autorun.inf system32.exe File opened for modification \??\G:\Autorun.inf smss.exe File opened for modification \??\Z:\Autorun.inf csrss.exe File opened for modification \??\J:\Autorun.inf Kazekage.exe File opened for modification \??\S:\Autorun.inf system32.exe File created \??\J:\Autorun.inf smss.exe File opened for modification \??\K:\Autorun.inf smss.exe File created \??\A:\Autorun.inf Gaara.exe File created \??\E:\Autorun.inf Gaara.exe File created \??\K:\Autorun.inf system32.exe File created \??\A:\Autorun.inf smss.exe File created \??\I:\Autorun.inf Kazekage.exe File opened for modification \??\J:\Autorun.inf system32.exe File created \??\V:\Autorun.inf system32.exe File opened for modification \??\H:\Autorun.inf 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created \??\K:\Autorun.inf Gaara.exe File opened for modification \??\G:\Autorun.inf csrss.exe File opened for modification \??\I:\Autorun.inf csrss.exe File opened for modification \??\X:\Autorun.inf Kazekage.exe File opened for modification \??\V:\Autorun.inf system32.exe File created \??\Y:\Autorun.inf system32.exe File created \??\G:\Autorun.inf Gaara.exe File created \??\J:\Autorun.inf csrss.exe File created \??\H:\Autorun.inf Kazekage.exe File created \??\X:\Autorun.inf Kazekage.exe File opened for modification \??\R:\Autorun.inf system32.exe File opened for modification \??\L:\Autorun.inf Kazekage.exe File opened for modification \??\X:\Autorun.inf smss.exe File opened for modification \??\H:\Autorun.inf Gaara.exe - Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\ Gaara.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Kazekage.exe File opened for modification C:\Windows\SysWOW64\22-5-2025.exe smss.exe File created C:\Windows\SysWOW64\Desktop.ini 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx system32.exe File opened for modification C:\Windows\SysWOW64\22-5-2025.exe system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini smss.exe File opened for modification C:\Windows\SysWOW64\ Kazekage.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini system32.exe File opened for modification C:\Windows\SysWOW64\22-5-2025.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\22-5-2025.exe csrss.exe File created C:\Windows\SysWOW64\mscomctl.ocx 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\ smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File created C:\Windows\SysWOW64\22-5-2025.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx smss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Gaara.exe File created C:\Windows\SysWOW64\msvbvm60.dll 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\22-5-2025.exe Gaara.exe File opened for modification C:\Windows\SysWOW64\ 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\ system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll csrss.exe File opened for modification C:\Windows\SysWOW64\22-5-2025.exe Kazekage.exe File created C:\Windows\SysWOW64\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini csrss.exe File opened for modification C:\Windows\SysWOW64\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll system32.exe File created C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\msvbvm60.dll system32.exe File opened for modification C:\Windows\SysWOW64\Desktop.ini Gaara.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\SysWOW64\ csrss.exe - Sets desktop wallpaper using registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe -
resource yara_rule behavioral2/memory/5468-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x001b00000002b1e8-11.dat upx behavioral2/files/0x001900000002b1e4-31.dat upx behavioral2/memory/5636-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5656-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5656-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x001a00000002b1e7-77.dat upx behavioral2/memory/5228-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x001b00000002b1e8-85.dat upx behavioral2/files/0x001900000002b1ea-93.dat upx behavioral2/files/0x001900000002b1eb-97.dat upx behavioral2/memory/5032-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x001900000002b1ea-134.dat upx behavioral2/files/0x001900000002b1eb-139.dat upx behavioral2/memory/3892-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5468-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5636-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5692-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5228-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x001400000002b1e9-181.dat upx behavioral2/memory/1096-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5368-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x001900000002b1eb-234.dat upx behavioral2/memory/1144-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5692-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5480-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5616-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5460-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/248-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5692-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5468-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5636-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5228-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5468-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5636-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5228-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x001400000002b1e9-557.dat upx behavioral2/memory/1144-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5692-587-0x0000000000400000-0x000000000042A000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system\mscoree.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe csrss.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\msvbvm60.dll system32.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\msvbvm60.dll 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe Gaara.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\system\msvbvm60.dll Kazekage.exe File opened for modification C:\Windows\msvbvm60.dll system32.exe File opened for modification C:\Windows\ smss.exe File opened for modification C:\Windows\mscomctl.ocx csrss.exe File created C:\Windows\Fonts\The Kazekage.jpg 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created C:\Windows\WBEM\msvbvm60.dll csrss.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe Gaara.exe File created C:\Windows\WBEM\msvbvm60.dll system32.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe smss.exe File opened for modification C:\Windows\mscomctl.ocx system32.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe smss.exe File opened for modification C:\Windows\system\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe Kazekage.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe Kazekage.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe Kazekage.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe Kazekage.exe File created C:\Windows\system\msvbvm60.dll 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\msvbvm60.dll csrss.exe File opened for modification C:\Windows\system\msvbvm60.dll system32.exe File opened for modification C:\Windows\ Kazekage.exe File created C:\Windows\msvbvm60.dll 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe csrss.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe csrss.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe system32.exe File opened for modification C:\Windows\mscomctl.ocx Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg smss.exe File opened for modification C:\Windows\system\mscoree.dll smss.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Gaara.exe File opened for modification C:\Windows\msvbvm60.dll csrss.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe Kazekage.exe File opened for modification C:\Windows\mscomctl.ocx 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe Gaara.exe File opened for modification C:\Windows\system\mscoree.dll 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\msvbvm60.dll 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\Fonts\The Kazekage.jpg Kazekage.exe File opened for modification C:\Windows\system\mscoree.dll system32.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe smss.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe csrss.exe File opened for modification C:\Windows\msvbvm60.dll Kazekage.exe File created C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe system32.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe system32.exe File created C:\Windows\mscomctl.ocx 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe smss.exe File created C:\Windows\WBEM\msvbvm60.dll Gaara.exe File opened for modification C:\Windows\system\msvbvm60.dll csrss.exe File opened for modification C:\Windows\ 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe File opened for modification C:\Windows\ Gaara.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kazekage.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 36 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4756 ping.exe 3524 ping.exe 2820 ping.exe 2692 ping.exe 556 ping.exe 3568 ping.exe 4108 ping.exe 4844 ping.exe 4856 ping.exe 1976 ping.exe 456 ping.exe 3160 ping.exe 5360 ping.exe 1860 ping.exe 2088 ping.exe 4276 ping.exe 5084 ping.exe 1200 ping.exe 1352 ping.exe 5000 ping.exe 888 ping.exe 2236 ping.exe 2280 ping.exe 3012 ping.exe 6056 ping.exe 5640 ping.exe 3940 ping.exe 5676 ping.exe 5524 ping.exe 996 ping.exe 1456 ping.exe 5948 ping.exe 4324 ping.exe 2628 ping.exe 5604 ping.exe 6100 ping.exe - Modifies Control Panel 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Speed = "4" smss.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" system32.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Speed = "4" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Speed = "4" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Size = "72" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\WallpaperStyle = "2" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Size = "72" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\WallpaperStyle = "2" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0" smss.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Size = "72" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Speed = "4" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" Kazekage.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\WallpaperStyle = "2" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\WallpaperStyle = "2" smss.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Speed = "4" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Size = "72" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee csrss.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop system32.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg" Gaara.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Kazekage.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" Gaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" system32.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main Gaara.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main smss.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!" csrss.exe Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Software\Microsoft\Internet Explorer\Main Kazekage.exe - Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe" Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install Kazekage.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" Gaara.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe" smss.exe - Runs ping.exe 1 TTPs 36 IoCs
pid Process 4844 ping.exe 4856 ping.exe 456 ping.exe 2236 ping.exe 5360 ping.exe 5676 ping.exe 5604 ping.exe 3012 ping.exe 556 ping.exe 6100 ping.exe 3940 ping.exe 5524 ping.exe 5948 ping.exe 1456 ping.exe 2628 ping.exe 5640 ping.exe 3160 ping.exe 3524 ping.exe 2280 ping.exe 996 ping.exe 5000 ping.exe 6056 ping.exe 2692 ping.exe 2088 ping.exe 1200 ping.exe 4324 ping.exe 4276 ping.exe 1860 ping.exe 2820 ping.exe 1352 ping.exe 4756 ping.exe 5084 ping.exe 888 ping.exe 1976 ping.exe 3568 ping.exe 4108 ping.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 5692 Kazekage.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 1144 system32.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 5636 smss.exe 5656 smss.exe 5228 Gaara.exe 5096 smss.exe 5032 Gaara.exe 4704 csrss.exe 3892 smss.exe 784 Gaara.exe 4856 csrss.exe 5692 Kazekage.exe 4896 Gaara.exe 1096 csrss.exe 5368 smss.exe 4876 Kazekage.exe 5480 Gaara.exe 2488 csrss.exe 1144 system32.exe 2240 Kazekage.exe 3124 system32.exe 1664 smss.exe 2936 system32.exe 1848 Gaara.exe 3544 csrss.exe 2160 Kazekage.exe 5616 system32.exe 2004 Kazekage.exe 5380 csrss.exe 4372 Kazekage.exe 5460 system32.exe 248 system32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5468 wrote to memory of 5636 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 79 PID 5468 wrote to memory of 5636 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 79 PID 5468 wrote to memory of 5636 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 79 PID 5636 wrote to memory of 5656 5636 smss.exe 80 PID 5636 wrote to memory of 5656 5636 smss.exe 80 PID 5636 wrote to memory of 5656 5636 smss.exe 80 PID 5636 wrote to memory of 5228 5636 smss.exe 81 PID 5636 wrote to memory of 5228 5636 smss.exe 81 PID 5636 wrote to memory of 5228 5636 smss.exe 81 PID 5228 wrote to memory of 5096 5228 Gaara.exe 82 PID 5228 wrote to memory of 5096 5228 Gaara.exe 82 PID 5228 wrote to memory of 5096 5228 Gaara.exe 82 PID 5228 wrote to memory of 5032 5228 Gaara.exe 83 PID 5228 wrote to memory of 5032 5228 Gaara.exe 83 PID 5228 wrote to memory of 5032 5228 Gaara.exe 83 PID 5228 wrote to memory of 4704 5228 Gaara.exe 84 PID 5228 wrote to memory of 4704 5228 Gaara.exe 84 PID 5228 wrote to memory of 4704 5228 Gaara.exe 84 PID 4704 wrote to memory of 3892 4704 csrss.exe 85 PID 4704 wrote to memory of 3892 4704 csrss.exe 85 PID 4704 wrote to memory of 3892 4704 csrss.exe 85 PID 4704 wrote to memory of 784 4704 csrss.exe 86 PID 4704 wrote to memory of 784 4704 csrss.exe 86 PID 4704 wrote to memory of 784 4704 csrss.exe 86 PID 4704 wrote to memory of 4856 4704 csrss.exe 87 PID 4704 wrote to memory of 4856 4704 csrss.exe 87 PID 4704 wrote to memory of 4856 4704 csrss.exe 87 PID 4704 wrote to memory of 5692 4704 csrss.exe 88 PID 4704 wrote to memory of 5692 4704 csrss.exe 88 PID 4704 wrote to memory of 5692 4704 csrss.exe 88 PID 5468 wrote to memory of 4896 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 89 PID 5468 wrote to memory of 4896 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 89 PID 5468 wrote to memory of 4896 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 89 PID 5692 wrote to memory of 5368 5692 Kazekage.exe 90 PID 5692 wrote to memory of 5368 5692 Kazekage.exe 90 PID 5692 wrote to memory of 5368 5692 Kazekage.exe 90 PID 5468 wrote to memory of 1096 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 91 PID 5468 wrote to memory of 1096 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 91 PID 5468 wrote to memory of 1096 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 91 PID 5468 wrote to memory of 4876 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 92 PID 5468 wrote to memory of 4876 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 92 PID 5468 wrote to memory of 4876 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 92 PID 5692 wrote to memory of 5480 5692 Kazekage.exe 93 PID 5692 wrote to memory of 5480 5692 Kazekage.exe 93 PID 5692 wrote to memory of 5480 5692 Kazekage.exe 93 PID 5692 wrote to memory of 2488 5692 Kazekage.exe 94 PID 5692 wrote to memory of 2488 5692 Kazekage.exe 94 PID 5692 wrote to memory of 2488 5692 Kazekage.exe 94 PID 5468 wrote to memory of 1144 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 95 PID 5468 wrote to memory of 1144 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 95 PID 5468 wrote to memory of 1144 5468 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe 95 PID 5692 wrote to memory of 2240 5692 Kazekage.exe 96 PID 5692 wrote to memory of 2240 5692 Kazekage.exe 96 PID 5692 wrote to memory of 2240 5692 Kazekage.exe 96 PID 5692 wrote to memory of 3124 5692 Kazekage.exe 97 PID 5692 wrote to memory of 3124 5692 Kazekage.exe 97 PID 5692 wrote to memory of 3124 5692 Kazekage.exe 97 PID 1144 wrote to memory of 1664 1144 system32.exe 98 PID 1144 wrote to memory of 1664 1144 system32.exe 98 PID 1144 wrote to memory of 1664 1144 system32.exe 98 PID 4704 wrote to memory of 2936 4704 csrss.exe 99 PID 4704 wrote to memory of 2936 4704 csrss.exe 99 PID 4704 wrote to memory of 2936 4704 csrss.exe 99 PID 1144 wrote to memory of 1848 1144 system32.exe 100 - System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Kazekage.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Gaara.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Gaara.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kazekage.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-22_a398ec442b3dcb1883a0f260a9c5f681_amadey_black-basta_elex_hijackloader_luca-stealer.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5468 -
C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5636 -
C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5656
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5228 -
C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5096
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5032
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4704 -
C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3892
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:784
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4856
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe5⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5692 -
C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5368
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5480
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2488
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2240
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3124
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2088
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5084
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2280
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:996
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1456
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6100
-
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2936
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2692
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2820
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3524
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2236
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4276
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655005⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:556
-
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2160
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5616
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5676
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4756
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5948
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4324
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5604
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3012
-
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5380
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4372
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:248
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4844
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3940
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1200
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:456
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5000
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5640
-
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4896
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1096
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4876
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1144 -
C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1664
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1848
-
-
C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3544
-
-
C:\Windows\SysWOW64\drivers\Kazekage.exeC:\Windows\system32\drivers\Kazekage.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
C:\Windows\SysWOW64\drivers\system32.exeC:\Windows\system32\drivers\system32.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5460
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:888
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4856
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1352
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2628
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655003⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3160
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655003⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6056
-
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5360
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1860
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1976
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5524
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.rasasayang.com.my 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3568
-
-
C:\Windows\SysWOW64\ping.exeping -a -l www.duniasex.com 655002⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Fonts\Admin 22 - 5 - 2025\smss.exe1⤵PID:3384
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Fonts\Admin 22 - 5 - 2025\Gaara.exe1⤵PID:3584
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c 22-5-2025.exe1⤵PID:6072
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c drivers\csrss.exe1⤵PID:772
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Admin Games\Readme.txt
- Size 736B
- SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
- MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
- SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
- SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
- MD5 SHA1 SHA512
- Path C:\Autorun.inf
- Size 196B
- SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
- MD5 1564dfe69ffed40950e5cb644e0894d1
- SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
- SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\Admin 22 - 5 - 2025\Gaara.exe
- Size 9.4MB
- SHA256 ff034e7c602ab3b5fa9649d97724211d6a80a93e3f1c733a7eb2b2ad2db22b30
- MD5 64a241da9ce2aafdcc166db135c04d82
- SHA1 46358a5775ca81bccfa0730c03dd630eadf78396
- SHA512 63b5229b53b6f21088540bacfc188fecc44f9ee87b23674d431539fe326b704a53be4872e6a871161af9f6d8efefbf31fe4aa27246c669ff1cc2d10a789bd68f
- SSDEEP 98304:NGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:+1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe
- Size 9.4MB
- SHA256 962ea01c16b8ec2a63e873eff76193e0dc2e63fb2f94621be9237a5f2ac5008a
- MD5 a398ec442b3dcb1883a0f260a9c5f681
- SHA1 71e480765f473a39f0a5e063a7f60eed13eb1b05
- SHA512 d060fa060f4571643e264ee0da02e7bf233f094389f5e46ca7470aa090586bfc9a028940b3ecbcf5906133db8da8d3432c3cd83ca43432f59ec806832b06098f
- SSDEEP 98304:nGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:g1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 22 - 5 - 2025\csrss.exe
- Size 9.4MB
- SHA256 5a71037c8a002c320c422fcec0d5e1b74816fe63f2645e36be62ca19d434d8a6
- MD5 f16370c64eeefa214d36861c96d53099
- SHA1 ee2ca124cf5288e783fe8aead272543008d02c78
- SHA512 947c223261066f9f46ec6de91a80727843a96acdcf8fd65bafd2969a402d8eff5cb527280941df2bc69bb1425b9a45c3a6a247054a0d504a2598ea63747bc226
- SSDEEP 98304:3GyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:w1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\Admin 22 - 5 - 2025\smss.exe
- Size 9.4MB
- SHA256 f65baca6aa0a272d8dfaf8eb56a124f29cf448071a3291488d2d87f7a4a28e72
- MD5 82b663b79348a96a3241d6701cff4616
- SHA1 1e5b1f8168d5a2dcfafa5675168e944010665384
- SHA512 6a7739079d0a32eab11e2c1580adcff8f749fae9d25eaae25b1a50f3e95336822f3bd5dbc13fa2b6c0abb654256a479fc217eadf85cb68bf599697bf60126f8c
- SSDEEP 98304:OGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:T1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\The Kazekage.jpg
- Size 1.4MB
- SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
- MD5 d6b05020d4a0ec2a3a8b687099e335df
- SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
- SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
- SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\22-5-2025.exe
- Size 9.4MB
- SHA256 74a0366bb980506fab8d816a40164ffd337b794f49ebaff38f4d7dd49a453afb
- MD5 e0eddcad607de9e4c500f951535e97be
- SHA1 d5113b9820e3d052417cecc42631e5748ce18f57
- SHA512 51eaf19577d12ddff10d130cd2f57588aa90c42e926af5de91d06e111a465d3068ecc152077c7aee7e9458567fd9f05f5e693763a9750b11855059ba852b181c
- SSDEEP 98304:+GyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:D1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\22-5-2025.exe
- Size 9.4MB
- SHA256 99e0a18cb27f68c2044c0e66c3cd5de658c0b3d2cb028df44db08726ea07cb40
- MD5 a82568ddb1be2dcc781fd086d68ee48f
- SHA1 62410a51ab5deb8adfcb8220f5a2f029f0bdc79c
- SHA512 4ce5f230b2d986ce19e7ce2799c5870fa5bcea001f13e8160863585c42c70a9b31b621092d63e5d85b72264f49bbe720ed24b21ff0ac7a685ac669012bd4c4b9
- SSDEEP 98304:kGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:x1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Desktop.ini
- Size 65B
- SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
- MD5 64acfa7e03b01f48294cf30d201a0026
- SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
- SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 9.4MB
- SHA256 580716a912357d35072a07713e93d6a70d7f0aacc4077592a81306cc850c6c9d
- MD5 4b8a48ac3e9fa6d6aa386c4c872e00d0
- SHA1 d3793f6266273c8189fed702db11a8372a5f8769
- SHA512 5e52221fd7c8cd80b5d20cf8f6862446da032c8950ec7d7f3f7f6c3a1739dcb6ea69fef6cf6f373d9349e78f15bab4f680c05c8f44e053c9131f7a642232f0f5
- SSDEEP 98304:hGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:y1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\Kazekage.exe
- Size 9.4MB
- SHA256 4850c8d0afc4cecfa0cfd33da7bd1f60496a915de68a0a32831245872c9427e1
- MD5 38a7d1c629932afaed678b8c3063849a
- SHA1 a0086959efa8217785f505e9e9ef6763b64fa834
- SHA512 df0b9418cf5b1bd21a9d93cf7558252d521ef7e6df779271344dcbceb665b5a9107471e3d46d00077c1884e6a8d8a0014a6dd0670465ad450d032cb5bec67585
- SSDEEP 98304:PGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:Y1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 9.4MB
- SHA256 eb1d04941178015f2c44fb430c4676df050c80ff4f17f184359ffb804cd75c6b
- MD5 d4f174536719292ad914ba153e64835d
- SHA1 a1abe67a5f96dcc685559750d093f580591e8098
- SHA512 9cbc31d96460af06115b07d761d28c37248489a7e9b1e9e8fddbff3f71ec12202d02ff78441349f8bdd743462b0db982055f6b65a1dc3768add696ee753f7227
- SSDEEP 98304:dGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:O1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 9.4MB
- SHA256 a467cf136736304596d6e7157ec322ce0f4abb8fe32ad608b0d178e0fbd9500f
- MD5 8264df864e43ab6c0585ac3ae192dec2
- SHA1 c1edce9d27b559be777c712fb244645c5276ecd5
- SHA512 72e2ae4dfad467ac196e21d54c33bae74f7f81601855d6d149cc6b0caff5971107db4de5dec43099be1ef74a493f18c20a7849d4f75fd62c99f21aa36886c677
- SSDEEP 98304:qGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:P1eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\drivers\system32.exe
- Size 9.4MB
- SHA256 96d6bbdbc4c79075d0f1c84c17dedcd10c6178f04158d87716251d00008cf4e8
- MD5 d15496274e3f10d11905a3843078b3da
- SHA1 1544117a48e9c90c5bbdf667e66f4c45c300aada
- SHA512 b30235f78731102bf1353a0aa4f2945a498db9a8cc908d0247a2242502a326874277cb05a93107c41546d751f7a311a88508d8c5ea54c0b857e8ac5769708e60
- SSDEEP 98304:zGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvb:81eHL5dEvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP