Analysis

  • max time kernel
    17s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/07/2025, 18:50

General

  • Target

    2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

  • Size

    1.4MB

  • MD5

    e3b7f7180b4b4267673d143afd3565af

  • SHA1

    37f142706b7e25cea3b1cff296a370ff57eb6843

  • SHA256

    b4abd8c9af8f4a1c2bcddd8ed5a52e31954b016f798f44844791bb1c9ad8a15f

  • SHA512

    c5444ed51a236de4db561c620b93d69264a0b6ad3c43b119efda22d9e80cec278dc6ebf110c8c1df868938e8b0dcf1808b4f4c179b6a03cc496dcae275e8cfa5

  • SSDEEP

    24576:cnsJ39LyjbJkQFMhmC+6GD9UW6VXRhP26zyxd5cb6h/1MPc:cnsHyjtk2MYC5GDv6ByGK/1P

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

darkcomet

Botnet

guest

C2

mori.giize.com:1604

Mutex

DCMIN_MUTEX-RE8T7MY

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    D2eMrnnPZXw7

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:6016
    • C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5896
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Windows\VPSTOOL.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4652
        • C:\Windows\windowsupdate.exe
          C:\Windows\windowsupdate.exe
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5460
          • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
            "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2292
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:6120
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\ProgramData\Synaptics\Synaptics.exe
      C:\ProgramData\Synaptics\Synaptics.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3888
      • C:\Windows\SysWOW64\._cache_Synaptics.exe
        "C:\Windows\system32\._cache_Synaptics.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3680
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
      C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2104
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4572

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Synaptics\Synaptics.exe

          Filesize

          1.4MB

          MD5

          e3b7f7180b4b4267673d143afd3565af

          SHA1

          37f142706b7e25cea3b1cff296a370ff57eb6843

          SHA256

          b4abd8c9af8f4a1c2bcddd8ed5a52e31954b016f798f44844791bb1c9ad8a15f

          SHA512

          c5444ed51a236de4db561c620b93d69264a0b6ad3c43b119efda22d9e80cec278dc6ebf110c8c1df868938e8b0dcf1808b4f4c179b6a03cc496dcae275e8cfa5

        • C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

          Filesize

          680KB

          MD5

          a1755b8c749b4e0fd0789ca9adbf91bd

          SHA1

          f3ca65ce3e97af30e3395dff087f5d0036d5ea38

          SHA256

          69a0b221da95d37de2507575352ebf748e238364129a9ddbbd0a44b106330d6d

          SHA512

          f76e399f50b53aaceac44fd1f17430e0685fbd02a4d9849be5be94c81402345bf09de573a5adcc4a276aae1e9beb55b4b404bbbeca2f0d572a79ba66c8245914

        • C:\Users\Admin\AppData\Local\Temp\50775E00

          Filesize

          20KB

          MD5

          6f93bb2f65c1afd109f1b5e1bcae041a

          SHA1

          d2bb86aec65967d869988c87d9ed2dcc42cee62c

          SHA256

          0f3722653f09a5b11155c8c230f093abdeadd0fa39419339d84352119a28741e

          SHA512

          5694641ae862796e86ba5c66214c6f167629afc8714aaa4a68ed77de5e52ae1ad05aaeb89d6e4da901f63fe94d128da591dbd6970371f5e30a599f7f6a455aab

        • C:\Users\Admin\AppData\Local\Temp\NLQeAv3E.xlsm

          Filesize

          17KB

          MD5

          e566fc53051035e1e6fd0ed1823de0f9

          SHA1

          00bc96c48b98676ecd67e81a6f1d7754e4156044

          SHA256

          8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

          SHA512

          a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

        • C:\Windows\VPSTOOL.bat

          Filesize

          2KB

          MD5

          41ee125c368186c6d384209990d58acf

          SHA1

          ce7c6593714d7f68c14e0e982f20fa79179262dc

          SHA256

          11b03f007190de1639813eecf51ef17c7018763943b33f8cd86e17956004671c

          SHA512

          030250c8fbf24172145afcb3eb06deaa009ecb52097e6ed97c35b840a851d3fccd4b201178db0a72e6ed821b12156754082ddab049753f964006fe5e5f9e64da

        • C:\Windows\back.exe

          Filesize

          294KB

          MD5

          cbee84dba7cb855aff0ba5e977030b98

          SHA1

          fbfa18e7fd6e8a9bbe812083808cd2b214d3ad15

          SHA256

          e02983386ab9a22beb5f053103505f9e779abdf583baa2eb25cde42f94083329

          SHA512

          bfe4ddefa05a4c9da93e71737249ed7cb9759dbcd7938b68fae23a29bab3c6246b5bee6b5529ef01ee582ca075b75c40ce18a76cdd4f0a1001a15d4a2fe4d235

        • C:\Windows\windowsupdate.exe

          Filesize

          232KB

          MD5

          2cb91c11ad3e1e2fd299bf39e340b7ea

          SHA1

          aa8b9e77344502bcf7e622f5afd384a30f1fd8b5

          SHA256

          d036b55a6a557ea9ff5334c416d58f3375ee3cb73f6b0e40e89c793f47d6f506

          SHA512

          9f3edd1d6f88ca0bb54702d5efc2b895eedf991794122346fb43b5deac77f6b9582fc8ff8e6cafc69dfe499b5031d360f4e126d80c427b9c9effeb1cc4ee9964

        • memory/2104-295-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2104-182-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2104-289-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2104-273-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2104-321-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2104-327-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2292-184-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/3888-274-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/3888-276-0x0000000002AE0000-0x0000000002B97000-memory.dmp

          Filesize

          732KB

        • memory/3888-319-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/3888-209-0x0000000002AE0000-0x0000000002B97000-memory.dmp

          Filesize

          732KB

        • memory/3888-277-0x0000000002AE0000-0x0000000002B97000-memory.dmp

          Filesize

          732KB

        • memory/3888-208-0x0000000002AE0000-0x0000000002B97000-memory.dmp

          Filesize

          732KB

        • memory/4548-275-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/4572-224-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

          Filesize

          64KB

        • memory/4572-222-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

          Filesize

          64KB

        • memory/4572-227-0x00007FFF222B0000-0x00007FFF222C0000-memory.dmp

          Filesize

          64KB

        • memory/4572-223-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

          Filesize

          64KB

        • memory/4572-221-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

          Filesize

          64KB

        • memory/4572-226-0x00007FFF222B0000-0x00007FFF222C0000-memory.dmp

          Filesize

          64KB

        • memory/4572-220-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

          Filesize

          64KB

        • memory/5460-229-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/5460-168-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/6016-0-0x0000000002400000-0x0000000002401000-memory.dmp

          Filesize

          4KB

        • memory/6016-104-0x0000000000400000-0x000000000056D000-memory.dmp

          Filesize

          1.4MB

        • memory/6016-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

          Filesize

          4KB