Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2025, 18:53

General

  • Target

    2025-07-02_d627a02bd7c66fde7aded5cd3663c88e_black-basta_darkgate_elex_luca-stealer.exe

  • Size

    1.2MB

  • MD5

    d627a02bd7c66fde7aded5cd3663c88e

  • SHA1

    005e01a8f50b32475a91fe70b41031f92439963e

  • SHA256

    3d52cd593b20c3d040d4227ac0d3e4477f8d11289b5208946a12f826315da04b

  • SHA512

    697476fedc69e522f6e079b8cfa2aa2448b24ae31e2f773dd2a7cdc086b3f6429c51ba040f8eec208d6ff191ae9188a6badfdd6056feb7b142240d9b8fa2d594

  • SSDEEP

    3072:tZTz1WIXC6GESSgWNRXumi7+IF6foPCaTRMXbaev0FQcmWk6kwsNIf6cHzbQ2v0V:tZHcIX9SSgMi+IFZMbQrkodzb4VF2Yd

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_d627a02bd7c66fde7aded5cd3663c88e_black-basta_darkgate_elex_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_d627a02bd7c66fde7aded5cd3663c88e_black-basta_darkgate_elex_luca-stealer.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6104
    • C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe
      "C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -Path "C:\Users\Admin\AppData\Local\Microsoft\local.cs"; [LocalServ]::Listen()
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4740
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\smatrb0s\smatrb0s.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4936
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES70DA.tmp" "c:\Users\Admin\AppData\Local\Temp\smatrb0s\CSCB47B7100F5344BA4B487FDD0875CAEA7.TMP"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5664

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe

          Filesize

          1.2MB

          MD5

          469fd782af6c3b7ebd247a8888ef9ba7

          SHA1

          533c6809a756438d7dd3805d4a0d2ed7b50ff8c6

          SHA256

          9e9bcea693d130b97162f969c2cfe3f65335cada4bc262a487c57cac0597d919

          SHA512

          9bba2eabbbdf7116d55d9087ea5fb9ce04b0e86accc6fb1b5a0ed6fb173621f1a93352bdba5c84e9f8d6cf609c51a63384e8b5d24d4911f4c781abf82fe3a0fd

        • C:\Users\Admin\AppData\Local\Microsoft\local.cs

          Filesize

          4KB

          MD5

          ff169c4274b91df68a1a0548b9186b29

          SHA1

          e2a406a1a49c5825d4f4279e82d1ca369433b244

          SHA256

          6da3e26b268e4a6c21e192c8b9a1b89aef6880bad673b79e6a889d29641ac2cc

          SHA512

          8785d91046722c0e8278fb95404ae284c3cf5e96060d06a7dc2209866b96618978e41844759da30fec7bdcef677fada61d3db498adbe989eaa87fbf84fc3366b

        • C:\Users\Admin\AppData\Local\Temp\RES70DA.tmp

          Filesize

          1KB

          MD5

          371a693ad1e141a2094432b8584bc0ca

          SHA1

          1ee60b26479e08d04456971c82f07f2992dada5f

          SHA256

          490c3c7f062d43c62e533eb28d1b47ba2b91a47657febff478b7743e4f48aa79

          SHA512

          6c38b1cbe79a3fb079fd601f2d238c3907e39668c6b28a796da4b50cf597e22b34565764e0390da0323e4b19b67469b14e73c33c46c135f47e23cc72d5d7755d

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2kv3twij.hf2.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\smatrb0s\smatrb0s.dll

          Filesize

          6KB

          MD5

          36869d2c6a6facc5d06b167b7a715452

          SHA1

          f0cf222e48826dbd450bd30b0fdfb2c4a0e0fe7c

          SHA256

          5b434b5e23275f1adc0f7febceddc9fec1de604b4517fced565fb1849d61be67

          SHA512

          60e41e3378b4e7b7fe67265b9f6a2c68d564ee2ca8b1dfa07c0d835887316e200dd0b43dfe324b3bdcd8f8aa82511207d303eb9c7a2c0c63d88c5779e09fdbb8

        • \??\c:\Users\Admin\AppData\Local\Temp\smatrb0s\CSCB47B7100F5344BA4B487FDD0875CAEA7.TMP

          Filesize

          652B

          MD5

          bdc4a4485a92e6ccf0f0cd40cd56bfb7

          SHA1

          ec94031585f64297b3b799ff0d62f1526b561378

          SHA256

          ed5e23ac32b585550451cab0b425bd42f6d650694cb043a2085eec9876736aff

          SHA512

          870a413a1352f7874e6cc9c17679d246cab33066f57e66b2668acd11ea21f0d5694f55b0cc596740948ef9905f59cea7b184baa56721a11d5957e4c5eeb4679a

        • \??\c:\Users\Admin\AppData\Local\Temp\smatrb0s\smatrb0s.cmdline

          Filesize

          360B

          MD5

          4b25acf9f8835ca96ccb87b82d7aec76

          SHA1

          0c10c17596bb6b39e5eb73a933bc3839e789c4a6

          SHA256

          e40532dc3aa16c82efdfda1876f25f5f6dd9105bd345a60f9affc8903fcde288

          SHA512

          392df6d8a23bc330ab495914dbe7bd70a2b8abd76c1ab879a25aff2e2157c717b50665c9ea11353688b7114c96fe5412e4a8a77e355ccd929ad553649e497a80

        • memory/2656-19-0x0000000000D30000-0x0000000000D40000-memory.dmp

          Filesize

          64KB

        • memory/2656-21-0x0000000000D30000-0x0000000000D40000-memory.dmp

          Filesize

          64KB

        • memory/2656-20-0x0000000000D30000-0x0000000000D40000-memory.dmp

          Filesize

          64KB

        • memory/2656-18-0x0000000000DA0000-0x0000000000DB6000-memory.dmp

          Filesize

          88KB

        • memory/2656-60-0x0000000000D30000-0x0000000000D40000-memory.dmp

          Filesize

          64KB

        • memory/2656-61-0x0000000000D30000-0x0000000000D40000-memory.dmp

          Filesize

          64KB

        • memory/2656-58-0x00000000062B0000-0x00000000062BA000-memory.dmp

          Filesize

          40KB

        • memory/2656-57-0x00000000062C0000-0x0000000006352000-memory.dmp

          Filesize

          584KB

        • memory/2656-59-0x0000000000D30000-0x0000000000D40000-memory.dmp

          Filesize

          64KB

        • memory/2656-62-0x0000000000D30000-0x0000000000D40000-memory.dmp

          Filesize

          64KB

        • memory/4740-25-0x00000000029F0000-0x0000000002A00000-memory.dmp

          Filesize

          64KB

        • memory/4740-27-0x00000000053A0000-0x00000000053C2000-memory.dmp

          Filesize

          136KB

        • memory/4740-64-0x00000000029F0000-0x0000000002A00000-memory.dmp

          Filesize

          64KB

        • memory/4740-40-0x0000000006340000-0x000000000635E000-memory.dmp

          Filesize

          120KB

        • memory/4740-41-0x0000000006370000-0x00000000063BC000-memory.dmp

          Filesize

          304KB

        • memory/4740-42-0x00000000079A0000-0x000000000801A000-memory.dmp

          Filesize

          6.5MB

        • memory/4740-43-0x0000000006860000-0x000000000687A000-memory.dmp

          Filesize

          104KB

        • memory/4740-63-0x00000000029F0000-0x0000000002A00000-memory.dmp

          Filesize

          64KB

        • memory/4740-28-0x0000000005C20000-0x0000000005C86000-memory.dmp

          Filesize

          408KB

        • memory/4740-29-0x0000000005D40000-0x0000000005DA6000-memory.dmp

          Filesize

          408KB

        • memory/4740-23-0x00000000029F0000-0x0000000002A00000-memory.dmp

          Filesize

          64KB

        • memory/4740-39-0x0000000005EB0000-0x0000000006204000-memory.dmp

          Filesize

          3.3MB

        • memory/4740-55-0x00000000068E0000-0x00000000068E8000-memory.dmp

          Filesize

          32KB

        • memory/4740-26-0x0000000005400000-0x0000000005A28000-memory.dmp

          Filesize

          6.2MB

        • memory/4740-24-0x0000000004D90000-0x0000000004DC6000-memory.dmp

          Filesize

          216KB

        • memory/6104-0-0x0000000004D00000-0x0000000004D10000-memory.dmp

          Filesize

          64KB

        • memory/6104-1-0x0000000000E40000-0x0000000000E56000-memory.dmp

          Filesize

          88KB

        • memory/6104-3-0x0000000004D00000-0x0000000004D10000-memory.dmp

          Filesize

          64KB

        • memory/6104-5-0x0000000004DF0000-0x0000000004E8C000-memory.dmp

          Filesize

          624KB

        • memory/6104-2-0x0000000004D00000-0x0000000004D10000-memory.dmp

          Filesize

          64KB

        • memory/6104-4-0x00000000052C0000-0x0000000005864000-memory.dmp

          Filesize

          5.6MB