Overview

overview

7

Static

static

3

2025-07-01...ar.exe

windows10-2004-x64

7

2025-07-01...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    102s
  • max time network
    105s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/07/2025, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-07-01_4269828f62e84701497bf7eb36288968_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
  • Size 15.7MB
  • Sample250701-e54vlasjz4
  • SHA256 4bf9e7642a8e226c0d8c5d245b9e1cd5b752239b0150d7e48e1b7a44acc41e2d
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 43 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-01_4269828f62e84701497bf7eb36288968_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-01_4269828f62e84701497bf7eb36288968_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\2025-07-01_4269828f62e84701497bf7eb36288968_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-07-01_4269828f62e84701497bf7eb36288968_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      PID:3096

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _raw_cbc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\Crypto\Cipher\_raw_cbc.pyd
        • Size 11KB
        • SHA256 62fb7dd417afd583393e759fc304ed43dfc6a562df9ebd70c5862ab8f9aad758
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cfb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\Crypto\Cipher\_raw_cfb.pyd
        • Size 12KB
        • SHA256 4bafae0151a6c644d12b00ca12a6aa02ff6d6221d7b30490c1054a78c10a6e31
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ctr.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\Crypto\Cipher\_raw_ctr.pyd
        • Size 14KB
        • SHA256 78b056004556a4805282c6fe3b24abc39d68f0654fbc1dd4a87dbf0bb57fc727
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ecb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\Crypto\Cipher\_raw_ecb.pyd
        • Size 10KB
        • SHA256 123945a792d8807e34de02010e24ce9db3c702ec52c2ea6e285587bbdc7fb422
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ofb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\Crypto\Cipher\_raw_ofb.pyd
        • Size 11KB
        • SHA256 49126d02214db06843a16ed5bd45e4a005f16faff18da22e2f2fb2f034c3cc94
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _BLAKE2s.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\Crypto\Hash\_BLAKE2s.pyd
        • Size 13KB
        • SHA256 52a0c78b45531ff8ba8ec4ebbfc8d23bb16990b71c71ddf90c7725661f050a1e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _strxor.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\Crypto\Util\_strxor.pyd
        • Size 10KB
        • SHA256 1fb951fb54743d2f89414487c9de624a9e9bfe13007fff3dd2fed5386b20947b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\VCRUNTIME140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_asyncio.pyd
        • Size 62KB
        • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _cffi_backend.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_cffi_backend.cp311-win_amd64.pyd
        • Size 174KB
        • SHA256 9aee90cf7980c8ff694bb3ffe06c71f87eb6a613033f73e3174a732648d39980
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_decimal.pyd
        • Size 245KB
        • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_multiprocessing.pyd
        • Size 32KB
        • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_overlapped.pyd
        • Size 48KB
        • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_sqlite3.pyd
        • Size 115KB
        • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_ssl.pyd
        • Size 155KB
        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\base_library.zip
        • Size 1.4MB
        • SHA256 5314a8fa90af3319c158b97d4d1a6cb05a86dd56967a4fdffeae2bc50788d3ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\pyexpat.pyd
        • Size 193KB
        • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\python3.DLL
        • Size 64KB
        • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\pywin32_system32\pywintypes311.dll
        • Size 132KB
        • SHA256 074a73db77cbd9a8a1eed34dbfeddcea2d5772d34f8761b94957ae463c9a16ae
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\sqlite3.dll
        • Size 1.4MB
        • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\win32\win32crypt.pyd
        • Size 121KB
        • SHA256 5616408486b4cb765d18efec1180710fe1c098703dc98b0d1cc5274579bb5e9a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download