Analysis
- max time kernel
101s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
03/08/2025, 03:58
General
- Target 2025-08-03_e4f64e1fdccad59e7ac20bc2db3dc2ef_amadey_black-basta_cryptbot_elex_luca-stealer_lynx.exe
- Size 1.9MB
- Sample250803-ejsv7sxsat
- SHA256 4cd0a2eb8662b5bdacf7f5db62827dd29a0c75d2b3b3f28eefb584e44a1ef2a5
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-08-03_e4f64e1fdccad59e7ac20bc2db3dc2ef_amadey_black-basta_cryptbot_elex_luca-stealer_lynx.exe"C:\Users\Admin\AppData\Local\Temp\2025-08-03_e4f64e1fdccad59e7ac20bc2db3dc2ef_amadey_black-basta_cryptbot_elex_luca-stealer_lynx.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Python313\pythonw.exe"C:\ProgramData\Python313\pythonw.exe" C:\ProgramData\Python313\__init__.py2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
__init__.py
_ctypes.pyd
libffi-8.dll
python3.dll
python313._pth
python313.dll
python313.zip
pythonw.exe
memory/1104-67-0x0000000003FA0000-0x0000000003FA1000-memory.dmp
memory/5708-0-0x0000000004900000-0x00000000065E0000-memory.dmp
memory/5708-4-0x0000000002C20000-0x00000000048FE000-memory.dmp