Malware Analysis Report

2025-08-10 19:49

Sample ID 250702-xg9p2szvez
Target 2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer
SHA256 b4abd8c9af8f4a1c2bcddd8ed5a52e31954b016f798f44844791bb1c9ad8a15f
Tags
xred darkcomet guest backdoor discovery persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b4abd8c9af8f4a1c2bcddd8ed5a52e31954b016f798f44844791bb1c9ad8a15f

Threat Level: Known bad

The file 2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer was found to be: Known bad.

Malicious Activity Summary

xred darkcomet guest backdoor discovery persistence rat trojan upx

Modifies WinLogon for persistence

Xred

Xred family

Darkcomet

Darkcomet family

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

UPX packed file

Drops file in System32 directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: AddClipboardFormatListener

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-07-02 18:50

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-07-02 18:50

Reported

2025-07-02 18:53

Platform

win10v2004-20250619-en

Max time kernel

144s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" C:\Windows\windowsupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" C:\Windows\windowsupdate.exe N/A

Xred

backdoor xred

Xred family

xred

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\Windows\windowsupdate.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\Windows\._cache_IMDCSC.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\._cache_IMDCSC.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Control Panel\International\Geo\Nation C:\Windows\windowsupdate.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" C:\Windows\windowsupdate.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" C:\Windows\windowsupdate.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe N/A
File created C:\Windows\SysWOW64\._cache_IMDCSC.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
File opened for modification C:\Windows\SysWOW64\._cache_IMDCSC.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
File created C:\Windows\SysWOW64\._cache_Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\__tmp_rar_sfx_access_check_240618750 C:\Windows\._cache_IMDCSC.exe N/A
File opened for modification C:\Windows\windowsupdate.exe C:\Windows\._cache_IMDCSC.exe N/A
File opened for modification C:\Windows\VPSTOOL.bat C:\Windows\._cache_IMDCSC.exe N/A
File opened for modification C:\Windows\back.exe C:\Windows\SysWOW64\._cache_IMDCSC.exe N/A
File opened for modification C:\Windows\windowsupdate.exe C:\Windows\SysWOW64\._cache_IMDCSC.exe N/A
File opened for modification C:\Windows\VPSTOOL.bat C:\Windows\SysWOW64\._cache_IMDCSC.exe N/A
File opened for modification C:\Windows\windowsupdate.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\back.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\back.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\VPSTOOL.bat C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\back.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\VPSTOOL.bat C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
File created C:\Windows\VPSTOOL.bat C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File created C:\Windows\._cache_IMDCSC.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
File opened for modification C:\Windows\VPSTOOL.bat C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\windowsupdate.exe C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240618906 C:\Windows\SysWOW64\._cache_IMDCSC.exe N/A
File created C:\Windows\windowsupdate.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\windowsupdate.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\windowsupdate.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\._cache_IMDCSC.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240617562 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240617859 C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\back.exe C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\back.exe C:\Windows\._cache_IMDCSC.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240616609 C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\windowsupdate.exe C:\Windows\SysWOW64\._cache_Synaptics.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\windowsupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\windowsupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\windowsupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\._cache_IMDCSC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\._cache_IMDCSC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: 33 N/A C:\Windows\windowsupdate.exe N/A
Token: 34 N/A C:\Windows\windowsupdate.exe N/A
Token: 35 N/A C:\Windows\windowsupdate.exe N/A
Token: 36 N/A C:\Windows\windowsupdate.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: 33 N/A C:\Windows\windowsupdate.exe N/A
Token: 34 N/A C:\Windows\windowsupdate.exe N/A
Token: 35 N/A C:\Windows\windowsupdate.exe N/A
Token: 36 N/A C:\Windows\windowsupdate.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4968 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
PID 4968 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
PID 4968 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
PID 4968 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4968 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4968 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4700 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4700 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4700 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4696 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Windows\SysWOW64\cmd.exe
PID 4696 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Windows\SysWOW64\cmd.exe
PID 4696 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Windows\SysWOW64\cmd.exe
PID 3168 wrote to memory of 4556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 3168 wrote to memory of 4556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 3168 wrote to memory of 4556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 3144 wrote to memory of 2848 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3144 wrote to memory of 2848 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3144 wrote to memory of 2848 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 4556 wrote to memory of 3652 N/A C:\Windows\windowsupdate.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 4556 wrote to memory of 3652 N/A C:\Windows\windowsupdate.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 4556 wrote to memory of 3652 N/A C:\Windows\windowsupdate.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 2520 wrote to memory of 4404 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Windows\SysWOW64\._cache_Synaptics.exe
PID 2520 wrote to memory of 4404 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Windows\SysWOW64\._cache_Synaptics.exe
PID 2520 wrote to memory of 4404 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Windows\SysWOW64\._cache_Synaptics.exe
PID 2712 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 2712 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 2712 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 3652 wrote to memory of 1392 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe C:\Windows\._cache_IMDCSC.exe
PID 3652 wrote to memory of 1392 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe C:\Windows\._cache_IMDCSC.exe
PID 3652 wrote to memory of 1392 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe C:\Windows\._cache_IMDCSC.exe
PID 8 wrote to memory of 1760 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe C:\Windows\SysWOW64\._cache_IMDCSC.exe
PID 8 wrote to memory of 1760 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe C:\Windows\SysWOW64\._cache_IMDCSC.exe
PID 8 wrote to memory of 1760 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe C:\Windows\SysWOW64\._cache_IMDCSC.exe
PID 1392 wrote to memory of 1920 N/A C:\Windows\._cache_IMDCSC.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 1920 N/A C:\Windows\._cache_IMDCSC.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 1920 N/A C:\Windows\._cache_IMDCSC.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 4744 N/A C:\Windows\SysWOW64\._cache_IMDCSC.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 4744 N/A C:\Windows\SysWOW64\._cache_IMDCSC.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 4744 N/A C:\Windows\SysWOW64\._cache_IMDCSC.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 1920 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 1920 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 2420 wrote to memory of 3248 N/A C:\Windows\windowsupdate.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 2420 wrote to memory of 3248 N/A C:\Windows\windowsupdate.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 2420 wrote to memory of 3248 N/A C:\Windows\windowsupdate.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 4744 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 4744 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 4744 wrote to memory of 316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Windows\VPSTOOL.bat" "

C:\Windows\windowsupdate.exe

C:\Windows\windowsupdate.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"

C:\Windows\SysWOW64\._cache_Synaptics.exe

"C:\Windows\system32\._cache_Synaptics.exe"

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

C:\Windows\._cache_IMDCSC.exe

"C:\Windows\._cache_IMDCSC.exe"

C:\Windows\SysWOW64\._cache_IMDCSC.exe

"C:\Windows\system32\._cache_IMDCSC.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Windows\VPSTOOL.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Windows\VPSTOOL.bat" "

C:\Windows\windowsupdate.exe

C:\Windows\windowsupdate.exe

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"

C:\Windows\windowsupdate.exe

C:\Windows\windowsupdate.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 mori.giize.com udp
IR 92.242.208.237:1604 mori.giize.com tcp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
IR 92.242.208.237:1604 mori.giize.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
IR 92.242.208.237:1604 mori.giize.com tcp
US 8.8.8.8:53 docs.google.com udp
GB 142.251.30.100:443 docs.google.com tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.193:443 drive.usercontent.google.com tcp
IR 92.242.208.237:1604 mori.giize.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
IR 92.242.208.237:1604 mori.giize.com tcp
IR 92.242.208.237:1604 mori.giize.com tcp
US 8.8.8.8:53 mori.giize.com udp
IR 92.242.208.237:1604 mori.giize.com tcp

Files

memory/4968-0-0x00000000023F0000-0x00000000023F1000-memory.dmp

memory/4968-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

MD5 a1755b8c749b4e0fd0789ca9adbf91bd
SHA1 f3ca65ce3e97af30e3395dff087f5d0036d5ea38
SHA256 69a0b221da95d37de2507575352ebf748e238364129a9ddbbd0a44b106330d6d
SHA512 f76e399f50b53aaceac44fd1f17430e0685fbd02a4d9849be5be94c81402345bf09de573a5adcc4a276aae1e9beb55b4b404bbbeca2f0d572a79ba66c8245914

C:\ProgramData\Synaptics\Synaptics.exe

MD5 e3b7f7180b4b4267673d143afd3565af
SHA1 37f142706b7e25cea3b1cff296a370ff57eb6843
SHA256 b4abd8c9af8f4a1c2bcddd8ed5a52e31954b016f798f44844791bb1c9ad8a15f
SHA512 c5444ed51a236de4db561c620b93d69264a0b6ad3c43b119efda22d9e80cec278dc6ebf110c8c1df868938e8b0dcf1808b4f4c179b6a03cc496dcae275e8cfa5

memory/4968-102-0x0000000000400000-0x000000000056D000-memory.dmp

memory/3144-104-0x0000000000400000-0x000000000056D000-memory.dmp

memory/3144-107-0x0000000000400000-0x000000000056D000-memory.dmp

C:\Windows\VPSTOOL.bat

MD5 41ee125c368186c6d384209990d58acf
SHA1 ce7c6593714d7f68c14e0e982f20fa79179262dc
SHA256 11b03f007190de1639813eecf51ef17c7018763943b33f8cd86e17956004671c
SHA512 030250c8fbf24172145afcb3eb06deaa009ecb52097e6ed97c35b840a851d3fccd4b201178db0a72e6ed821b12156754082ddab049753f964006fe5e5f9e64da

memory/4556-170-0x0000000000400000-0x00000000004B7000-memory.dmp

C:\Windows\windowsupdate.exe

MD5 2cb91c11ad3e1e2fd299bf39e340b7ea
SHA1 aa8b9e77344502bcf7e622f5afd384a30f1fd8b5
SHA256 d036b55a6a557ea9ff5334c416d58f3375ee3cb73f6b0e40e89c793f47d6f506
SHA512 9f3edd1d6f88ca0bb54702d5efc2b895eedf991794122346fb43b5deac77f6b9582fc8ff8e6cafc69dfe499b5031d360f4e126d80c427b9c9effeb1cc4ee9964

memory/3144-195-0x0000000003EA0000-0x0000000003F57000-memory.dmp

memory/3144-194-0x0000000003EA0000-0x0000000003F57000-memory.dmp

memory/1336-200-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

memory/1336-199-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

memory/1336-202-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

memory/1336-208-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

memory/1336-198-0x00007FFE2ECB0000-0x00007FFE2ECC0000-memory.dmp

memory/2520-211-0x0000000000400000-0x000000000056D000-memory.dmp

C:\Windows\back.exe

MD5 cbee84dba7cb855aff0ba5e977030b98
SHA1 fbfa18e7fd6e8a9bbe812083808cd2b214d3ad15
SHA256 e02983386ab9a22beb5f053103505f9e779abdf583baa2eb25cde42f94083329
SHA512 bfe4ddefa05a4c9da93e71737249ed7cb9759dbcd7938b68fae23a29bab3c6246b5bee6b5529ef01ee582ca075b75c40ce18a76cdd4f0a1001a15d4a2fe4d235

memory/1336-242-0x00007FFE2CBC0000-0x00007FFE2CBD0000-memory.dmp

memory/1336-249-0x00007FFE2CBC0000-0x00007FFE2CBD0000-memory.dmp

memory/4556-282-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3652-285-0x0000000000400000-0x000000000056D000-memory.dmp

memory/8-293-0x0000000000400000-0x000000000056D000-memory.dmp

C:\Windows\back.exe

MD5 6c87e484a8f8442fa2cada28e2726243
SHA1 e82a598d61564ff05cfaee00eb947c8259ee632e
SHA256 11440fc9fd8b1a332797f1a9794c8d7241488745154a459c2645b9b922e9b132
SHA512 4bdb972e0cbc4c21d630bff9c2857e062d9cf10f2eb05ccd0ff9739bf327849deb0dfc33fffef55d1ef3df643dc5676d5f907c6a9cf418145b1f77b6463fec6f

C:\Users\Admin\AppData\Local\Temp\KDlrjtMV.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

memory/2420-322-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/316-354-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/316-357-0x0000000000400000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\KDlrjtMV.xlsm

MD5 814624d05bf710356d66d57a9e4788d6
SHA1 778941deb01d7edb70e9388bc110699f20dbd99a
SHA256 d96f14c6d40776a713091baa6dca5007f26923d5b1c9d8b4ec295b2d65baca74
SHA512 dbe4b2be59b0d8c52a50c6ee6327439cc7a00c718bc51c752eacaa273e1676d0314297169af4557dd9fc1eb500e8d5150ce8273ff6803d0f439f9f66640171d0

memory/2420-381-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3144-382-0x0000000000400000-0x000000000056D000-memory.dmp

memory/3144-388-0x0000000003EA0000-0x0000000003F57000-memory.dmp

memory/3144-387-0x0000000003EA0000-0x0000000003F57000-memory.dmp

memory/3144-389-0x0000000000400000-0x000000000056D000-memory.dmp

memory/3248-393-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3248-398-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3248-402-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3144-424-0x0000000000400000-0x000000000056D000-memory.dmp

memory/3248-425-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3248-429-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3248-434-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3248-438-0x0000000000400000-0x00000000004B7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-07-02 18:50

Reported

2025-07-02 18:53

Platform

win11-20250610-en

Max time kernel

17s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" C:\Windows\windowsupdate.exe N/A

Xred

backdoor xred

Xred family

xred

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" C:\Windows\windowsupdate.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe N/A
File created C:\Windows\SysWOW64\._cache_Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\back.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\back.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\VPSTOOL.bat C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
File created C:\Windows\windowsupdate.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\back.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240609781 C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
File created C:\Windows\windowsupdate.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\windowsupdate.exe C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240608796 C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File created C:\Windows\back.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\windowsupdate.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\windowsupdate.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\VPSTOOL.bat C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\windowsupdate.exe C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
File created C:\Windows\VPSTOOL.bat C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\VPSTOOL.bat C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
File opened for modification C:\Windows\back.exe C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_240609828 C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\windowsupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\windowsupdate.exe N/A
Token: 33 N/A C:\Windows\windowsupdate.exe N/A
Token: 34 N/A C:\Windows\windowsupdate.exe N/A
Token: 35 N/A C:\Windows\windowsupdate.exe N/A
Token: 36 N/A C:\Windows\windowsupdate.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: 33 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: 34 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: 36 N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 6016 wrote to memory of 5896 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
PID 6016 wrote to memory of 5896 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
PID 6016 wrote to memory of 5896 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
PID 6016 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 6016 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 6016 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3116 wrote to memory of 3888 N/A C:\Windows\system32\cmd.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3116 wrote to memory of 3888 N/A C:\Windows\system32\cmd.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3116 wrote to memory of 3888 N/A C:\Windows\system32\cmd.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 5896 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Windows\SysWOW64\cmd.exe
PID 5896 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Windows\SysWOW64\cmd.exe
PID 5896 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe C:\Windows\SysWOW64\cmd.exe
PID 4652 wrote to memory of 5460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 4652 wrote to memory of 5460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 4652 wrote to memory of 5460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\windowsupdate.exe
PID 5460 wrote to memory of 2292 N/A C:\Windows\windowsupdate.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 5460 wrote to memory of 2292 N/A C:\Windows\windowsupdate.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 5460 wrote to memory of 2292 N/A C:\Windows\windowsupdate.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 2768 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 2768 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 2768 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
PID 3888 wrote to memory of 3680 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Windows\SysWOW64\._cache_Synaptics.exe
PID 3888 wrote to memory of 3680 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Windows\SysWOW64\._cache_Synaptics.exe
PID 3888 wrote to memory of 3680 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Windows\SysWOW64\._cache_Synaptics.exe
PID 4548 wrote to memory of 6120 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 4548 wrote to memory of 6120 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 4548 wrote to memory of 6120 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Windows\VPSTOOL.bat" "

C:\Windows\windowsupdate.exe

C:\Windows\windowsupdate.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

C:\Windows\SysWOW64\._cache_Synaptics.exe

"C:\Windows\system32\._cache_Synaptics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 mori.giize.com udp
IR 92.242.208.237:1604 mori.giize.com tcp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
IR 92.242.208.237:1604 mori.giize.com tcp
IR 92.242.208.237:1604 mori.giize.com tcp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.251.30.113:443 docs.google.com tcp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.187.193:443 drive.usercontent.google.com tcp
IR 92.242.208.237:1604 mori.giize.com tcp
IR 92.242.208.237:1604 mori.giize.com tcp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
IR 92.242.208.237:1604 mori.giize.com tcp
IR 92.242.208.237:1604 mori.giize.com tcp

Files

memory/6016-0-0x0000000002400000-0x0000000002401000-memory.dmp

memory/6016-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_2025-07-02_e3b7f7180b4b4267673d143afd3565af_black-basta_darkgate_elex_gcleaner_luca-stealer.exe

MD5 a1755b8c749b4e0fd0789ca9adbf91bd
SHA1 f3ca65ce3e97af30e3395dff087f5d0036d5ea38
SHA256 69a0b221da95d37de2507575352ebf748e238364129a9ddbbd0a44b106330d6d
SHA512 f76e399f50b53aaceac44fd1f17430e0685fbd02a4d9849be5be94c81402345bf09de573a5adcc4a276aae1e9beb55b4b404bbbeca2f0d572a79ba66c8245914

C:\ProgramData\Synaptics\Synaptics.exe

MD5 e3b7f7180b4b4267673d143afd3565af
SHA1 37f142706b7e25cea3b1cff296a370ff57eb6843
SHA256 b4abd8c9af8f4a1c2bcddd8ed5a52e31954b016f798f44844791bb1c9ad8a15f
SHA512 c5444ed51a236de4db561c620b93d69264a0b6ad3c43b119efda22d9e80cec278dc6ebf110c8c1df868938e8b0dcf1808b4f4c179b6a03cc496dcae275e8cfa5

memory/6016-104-0x0000000000400000-0x000000000056D000-memory.dmp

C:\Windows\VPSTOOL.bat

MD5 41ee125c368186c6d384209990d58acf
SHA1 ce7c6593714d7f68c14e0e982f20fa79179262dc
SHA256 11b03f007190de1639813eecf51ef17c7018763943b33f8cd86e17956004671c
SHA512 030250c8fbf24172145afcb3eb06deaa009ecb52097e6ed97c35b840a851d3fccd4b201178db0a72e6ed821b12156754082ddab049753f964006fe5e5f9e64da

C:\Windows\windowsupdate.exe

MD5 2cb91c11ad3e1e2fd299bf39e340b7ea
SHA1 aa8b9e77344502bcf7e622f5afd384a30f1fd8b5
SHA256 d036b55a6a557ea9ff5334c416d58f3375ee3cb73f6b0e40e89c793f47d6f506
SHA512 9f3edd1d6f88ca0bb54702d5efc2b895eedf991794122346fb43b5deac77f6b9582fc8ff8e6cafc69dfe499b5031d360f4e126d80c427b9c9effeb1cc4ee9964

memory/5460-168-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2104-182-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2292-184-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3888-209-0x0000000002AE0000-0x0000000002B97000-memory.dmp

memory/3888-208-0x0000000002AE0000-0x0000000002B97000-memory.dmp

memory/4572-222-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

memory/4572-223-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

memory/4572-224-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

memory/4572-221-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

memory/4572-220-0x00007FFF24A30000-0x00007FFF24A40000-memory.dmp

memory/4572-226-0x00007FFF222B0000-0x00007FFF222C0000-memory.dmp

C:\Windows\back.exe

MD5 cbee84dba7cb855aff0ba5e977030b98
SHA1 fbfa18e7fd6e8a9bbe812083808cd2b214d3ad15
SHA256 e02983386ab9a22beb5f053103505f9e779abdf583baa2eb25cde42f94083329
SHA512 bfe4ddefa05a4c9da93e71737249ed7cb9759dbcd7938b68fae23a29bab3c6246b5bee6b5529ef01ee582ca075b75c40ce18a76cdd4f0a1001a15d4a2fe4d235

memory/4572-227-0x00007FFF222B0000-0x00007FFF222C0000-memory.dmp

memory/5460-229-0x0000000000400000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NLQeAv3E.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\50775E00

MD5 6f93bb2f65c1afd109f1b5e1bcae041a
SHA1 d2bb86aec65967d869988c87d9ed2dcc42cee62c
SHA256 0f3722653f09a5b11155c8c230f093abdeadd0fa39419339d84352119a28741e
SHA512 5694641ae862796e86ba5c66214c6f167629afc8714aaa4a68ed77de5e52ae1ad05aaeb89d6e4da901f63fe94d128da591dbd6970371f5e30a599f7f6a455aab

memory/2104-273-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3888-274-0x0000000000400000-0x000000000056D000-memory.dmp

memory/4548-275-0x0000000000400000-0x000000000056D000-memory.dmp

memory/3888-277-0x0000000002AE0000-0x0000000002B97000-memory.dmp

memory/3888-276-0x0000000002AE0000-0x0000000002B97000-memory.dmp

memory/2104-289-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2104-295-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3888-319-0x0000000000400000-0x000000000056D000-memory.dmp

memory/2104-321-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2104-327-0x0000000000400000-0x00000000004B7000-memory.dmp