Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
05/07/2025, 11:53
General
- Target 2025-07-05_f00e0eb5d59b531b7a9e5d464cad5285_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
- Size 4.2MB
- Sample250705-n2qm8sysfx
- SHA256 34af4929d133438058378eeaf3d1934788a3fc56998113a69b18082fe3788c76
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-07-05_f00e0eb5d59b531b7a9e5d464cad5285_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2025-07-05_f00e0eb5d59b531b7a9e5d464cad5285_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe"1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5264" "1288" "1232" "1284" "0" "0" "0" "0" "0" "0" "0" "0"2⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
jcmd.exe
jconsole.exe
jdb.exe
jdeps.exe
jhat.exe
jinfo.exe
jjs.exe
jmap.exe
jps.exe
jrunscript.exe
jsadebugd.exe
jstack.exe
jstat.exe
jstatd.exe
keytool.exe
kinit.exe
klist.exe
ktab.exe
native2ascii.exe
OneDriveUpdaterService-2025-07-05.1153.5264.1.aodl
Install_2025-07-05_115353_5264-5304.log
dotnet.exe
DiagnosticsHub.StandardCollector.Service.exe
alg.exe
AppVClient.exe
memory/2952-40-0x0000000000720000-0x0000000000780000-memory.dmp
memory/2952-47-0x0000000000720000-0x0000000000780000-memory.dmp
memory/2952-57-0x0000000140000000-0x0000000140227000-memory.dmp
memory/4456-87-0x0000000000870000-0x00000000008D0000-memory.dmp
memory/4456-250-0x0000000140000000-0x000000014024C000-memory.dmp
memory/4456-97-0x0000000140000000-0x000000014024C000-memory.dmp
memory/4456-93-0x0000000000870000-0x00000000008D0000-memory.dmp
memory/4592-248-0x0000000140000000-0x000000014025F000-memory.dmp
memory/4592-55-0x0000000000920000-0x0000000000980000-memory.dmp
memory/4592-49-0x0000000000920000-0x0000000000980000-memory.dmp
memory/4592-58-0x0000000140000000-0x000000014025F000-memory.dmp
memory/4976-72-0x0000000001AD0000-0x0000000001B30000-memory.dmp
memory/4976-83-0x0000000001AD0000-0x0000000001B30000-memory.dmp
memory/4976-85-0x0000000140000000-0x0000000140252000-memory.dmp
memory/4976-78-0x0000000001AD0000-0x0000000001B30000-memory.dmp
memory/4976-80-0x0000000140000000-0x0000000140252000-memory.dmp
memory/5020-70-0x0000000140000000-0x0000000140266000-memory.dmp
memory/5020-67-0x00000000008F0000-0x0000000000950000-memory.dmp
memory/5020-61-0x00000000008F0000-0x0000000000950000-memory.dmp
memory/5020-249-0x0000000140000000-0x0000000140266000-memory.dmp
memory/5264-30-0x0000000001F20000-0x0000000001F80000-memory.dmp
memory/5264-0-0x0000000001F20000-0x0000000001F80000-memory.dmp
memory/5264-36-0x0000000140000000-0x000000014044C000-memory.dmp
memory/5264-8-0x0000000140000000-0x000000014044C000-memory.dmp
memory/5264-9-0x0000000001F20000-0x0000000001F80000-memory.dmp
memory/5760-247-0x0000000140000000-0x0000000140227000-memory.dmp
memory/5760-21-0x0000000140000000-0x0000000140227000-memory.dmp
memory/5760-22-0x0000000000780000-0x00000000007E0000-memory.dmp
memory/5760-13-0x0000000000780000-0x00000000007E0000-memory.dmp