Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2025, 18:50

General

  • Target

    2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

  • Size

    1.4MB

  • MD5

    e3b7f7180b4b4267673d143afd3565af

  • SHA1

    37f142706b7e25cea3b1cff296a370ff57eb6843

  • SHA256

    b4abd8c9af8f4a1c2bcddd8ed5a52e31954b016f798f44844791bb1c9ad8a15f

  • SHA512

    c5444ed51a236de4db561c620b93d69264a0b6ad3c43b119efda22d9e80cec278dc6ebf110c8c1df868938e8b0dcf1808b4f4c179b6a03cc496dcae275e8cfa5

  • SSDEEP

    24576:cnsJ39LyjbJkQFMhmC+6GD9UW6VXRhP26zyxd5cb6h/1MPc:cnsHyjtk2MYC5GDv6ByGK/1P

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

darkcomet

Botnet

guest

C2

mori.giize.com:1604

Mutex

DCMIN_MUTEX-RE8T7MY

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    D2eMrnnPZXw7

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Windows\VPSTOOL.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3168
        • C:\Windows\windowsupdate.exe
          C:\Windows\windowsupdate.exe
          4⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4556
          • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
            "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3652
            • C:\Windows\._cache_IMDCSC.exe
              "C:\Windows\._cache_IMDCSC.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1392
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Windows\VPSTOOL.bat" "
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1920
                • C:\Windows\windowsupdate.exe
                  C:\Windows\windowsupdate.exe
                  8⤵
                  • Modifies WinLogon for persistence
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2420
                  • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
                    "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    PID:3248
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3144
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2848
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\ProgramData\Synaptics\Synaptics.exe
      C:\ProgramData\Synaptics\Synaptics.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Windows\SysWOW64\._cache_Synaptics.exe
        "C:\Windows\system32\._cache_Synaptics.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4404
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
      C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:8
      • C:\Windows\SysWOW64\._cache_IMDCSC.exe
        "C:\Windows\system32\._cache_IMDCSC.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Windows\VPSTOOL.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4744
          • C:\Windows\windowsupdate.exe
            C:\Windows\windowsupdate.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:316
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1336

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Synaptics\Synaptics.exe

          Filesize

          1.4MB

          MD5

          e3b7f7180b4b4267673d143afd3565af

          SHA1

          37f142706b7e25cea3b1cff296a370ff57eb6843

          SHA256

          b4abd8c9af8f4a1c2bcddd8ed5a52e31954b016f798f44844791bb1c9ad8a15f

          SHA512

          c5444ed51a236de4db561c620b93d69264a0b6ad3c43b119efda22d9e80cec278dc6ebf110c8c1df868938e8b0dcf1808b4f4c179b6a03cc496dcae275e8cfa5

        • C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

          Filesize

          680KB

          MD5

          a1755b8c749b4e0fd0789ca9adbf91bd

          SHA1

          f3ca65ce3e97af30e3395dff087f5d0036d5ea38

          SHA256

          69a0b221da95d37de2507575352ebf748e238364129a9ddbbd0a44b106330d6d

          SHA512

          f76e399f50b53aaceac44fd1f17430e0685fbd02a4d9849be5be94c81402345bf09de573a5adcc4a276aae1e9beb55b4b404bbbeca2f0d572a79ba66c8245914

        • C:\Users\Admin\AppData\Local\Temp\KDlrjtMV.xlsm

          Filesize

          22KB

          MD5

          814624d05bf710356d66d57a9e4788d6

          SHA1

          778941deb01d7edb70e9388bc110699f20dbd99a

          SHA256

          d96f14c6d40776a713091baa6dca5007f26923d5b1c9d8b4ec295b2d65baca74

          SHA512

          dbe4b2be59b0d8c52a50c6ee6327439cc7a00c718bc51c752eacaa273e1676d0314297169af4557dd9fc1eb500e8d5150ce8273ff6803d0f439f9f66640171d0

        • C:\Users\Admin\AppData\Local\Temp\KDlrjtMV.xlsm

          Filesize

          17KB

          MD5

          e566fc53051035e1e6fd0ed1823de0f9

          SHA1

          00bc96c48b98676ecd67e81a6f1d7754e4156044

          SHA256

          8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

          SHA512

          a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

        • C:\Windows\VPSTOOL.bat

          Filesize

          2KB

          MD5

          41ee125c368186c6d384209990d58acf

          SHA1

          ce7c6593714d7f68c14e0e982f20fa79179262dc

          SHA256

          11b03f007190de1639813eecf51ef17c7018763943b33f8cd86e17956004671c

          SHA512

          030250c8fbf24172145afcb3eb06deaa009ecb52097e6ed97c35b840a851d3fccd4b201178db0a72e6ed821b12156754082ddab049753f964006fe5e5f9e64da

        • C:\Windows\back.exe

          Filesize

          294KB

          MD5

          cbee84dba7cb855aff0ba5e977030b98

          SHA1

          fbfa18e7fd6e8a9bbe812083808cd2b214d3ad15

          SHA256

          e02983386ab9a22beb5f053103505f9e779abdf583baa2eb25cde42f94083329

          SHA512

          bfe4ddefa05a4c9da93e71737249ed7cb9759dbcd7938b68fae23a29bab3c6246b5bee6b5529ef01ee582ca075b75c40ce18a76cdd4f0a1001a15d4a2fe4d235

        • C:\Windows\back.exe

          Filesize

          294KB

          MD5

          6c87e484a8f8442fa2cada28e2726243

          SHA1

          e82a598d61564ff05cfaee00eb947c8259ee632e

          SHA256

          11440fc9fd8b1a332797f1a9794c8d7241488745154a459c2645b9b922e9b132

          SHA512

          4bdb972e0cbc4c21d630bff9c2857e062d9cf10f2eb05ccd0ff9739bf327849deb0dfc33fffef55d1ef3df643dc5676d5f907c6a9cf418145b1f77b6463fec6f

        • C:\Windows\windowsupdate.exe

          Filesize

          232KB

          MD5

          2cb91c11ad3e1e2fd299bf39e340b7ea

          SHA1

          aa8b9e77344502bcf7e622f5afd384a30f1fd8b5

          SHA256

          d036b55a6a557ea9ff5334c416d58f3375ee3cb73f6b0e40e89c793f47d6f506

          SHA512

          9f3edd1d6f88ca0bb54702d5efc2b895eedf991794122346fb43b5deac77f6b9582fc8ff8e6cafc69dfe499b5031d360f4e126d80c427b9c9effeb1cc4ee9964

        • memory/8-293-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/316-357-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/316-354-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/1336-249-0x00007FFE2CBC0000-0x00007FFE2CBD0000-memory.dmp

          Filesize

          64KB

        • memory/1336-200-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

          Filesize

          64KB

        • memory/1336-199-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

          Filesize

          64KB

        • memory/1336-202-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

          Filesize

          64KB

        • memory/1336-208-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

          Filesize

          64KB

        • memory/1336-198-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

          Filesize

          64KB

        • memory/1336-242-0x00007FFE2CBC0000-0x00007FFE2CBD0000-memory.dmp

          Filesize

          64KB

        • memory/2420-381-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2420-322-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2520-211-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/3144-382-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/3144-388-0x0000000003EA0000-0x0000000003F57000-memory.dmp

          Filesize

          732KB

        • memory/3144-195-0x0000000003EA0000-0x0000000003F57000-memory.dmp

          Filesize

          732KB

        • memory/3144-424-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/3144-107-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/3144-389-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/3144-104-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/3144-194-0x0000000003EA0000-0x0000000003F57000-memory.dmp

          Filesize

          732KB

        • memory/3144-387-0x0000000003EA0000-0x0000000003F57000-memory.dmp

          Filesize

          732KB

        • memory/3248-425-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/3248-402-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/3248-434-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/3248-393-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/3248-429-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/3248-398-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/3248-438-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/3652-285-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/4556-282-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4556-170-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4968-102-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/4968-0-0x00000000023F0000-0x00000000023F1000-memory.dmp

          Filesize

          4KB

        • memory/4968-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

          Filesize

          4KB