File name:	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer
Full analysis:	https://app.any.run/tasks/3591f483-105a-4550-942c-78971215a8be
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Phorpiex is a malicious software that has been a significant threat in the cybersecurity landscape since 2016. It is a modular malware known for its ability to maintain an extensive botnet. Unlike other botnets, Phorpiex does not concentrate on DDoS attacks. Instead, it has been involved in numerous large-scale spam email campaigns and the distribution of other malicious payloads, such as LockBit. Malware Trends Tracker >>>
Analysis date:	May 15, 2025, 18:48:50
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	loader auto-reg botnet phorpiex
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	AA77925ECF15058D401960A4239117D9
SHA1:	DE79B6355A3CA4152E6F6C208EDB370F935CCC4A
SHA256:	F6B5A14DD662F5B0C316952FBF4B0BCDACACD2A7AA53B3C1A669D3877ADEDFD2
SSDEEP:	6144:oJP8gMxfXHOznNnQlplsnbKSVnopSdXf7VSoj9bU:oJP8gJzNQlplsndVn6Sxbj9bU

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1970:01:01 15:50:05+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	14.16
CodeSize:	148992
InitializedDataSize:	86528
UninitializedDataSize:	-
EntryPoint:	0x3e000
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI
FileVersionNumber:	6.0.0.9
ProductVersionNumber:	6.0.0.9
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
CompanyName:	Advanced Micro Devices, Inc.
FileDescription:	AMD PPM Settings
FileVersion:	6.0.0.9
InternalName:	AMDPPMSettings.exe
LegalCopyright:	Copyright © 2020 Advanced Micro Devices, Inc.
OriginalFileName:	AMDPPMSettings.exe
ProductName:	AMD PPM Settings
ProductVersion:	6.0.0.9


(PID) Process:	(5720) 2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(5720) 2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(5720) 2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(1628) D3EC.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(1628) D3EC.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(1628) D3EC.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(4608) 226836941.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	Windows Settings
Value: C:\Users\admin\syscrondvr.exe
(PID) Process:	(5552) syscrondvr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(5552) syscrondvr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(5552) syscrondvr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:

PID	Process	Filename		Type
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	C:\Users\admin\Desktop\log.txt		text
		MD5:A2C36CD241D4E578CDC057BBF7D380DB	SHA256:7FE1E118A6DE1140C142CC48EBA09118D30CBD09C2AE69D506254186C11E236B
5552	syscrondvr.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\2[1]		binary
		MD5:23576C32EA5C1925C8A6BFECBE3D6F0A	SHA256:B876A2F8989160E9BF9479D454C1CD036D8796F4545E138CEE584848FEBC2085
1628	D3EC.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\newtpp[1].exe		executable
		MD5:F30FDBF3448F67CBC3566F31729CB7A6	SHA256:3A902ABB21D204ED6A0776789C9661F8B98E561FD0CA661EE37A7D8BD079E57B
5552	syscrondvr.exe	C:\Users\admin\AppData\Local\Temp\2051512899.exe		binary
		MD5:23576C32EA5C1925C8A6BFECBE3D6F0A	SHA256:B876A2F8989160E9BF9479D454C1CD036D8796F4545E138CEE584848FEBC2085
4608	226836941.exe	C:\Users\admin\syscrondvr.exe		executable
		MD5:F30FDBF3448F67CBC3566F31729CB7A6	SHA256:3A902ABB21D204ED6A0776789C9661F8B98E561FD0CA661EE37A7D8BD079E57B
1628	D3EC.exe	C:\Users\admin\AppData\Local\Temp\226836941.exe		executable
		MD5:F30FDBF3448F67CBC3566F31729CB7A6	SHA256:3A902ABB21D204ED6A0776789C9661F8B98E561FD0CA661EE37A7D8BD079E57B
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\32[1].exe		executable
		MD5:0EC46393976EB51F307CC11D80BAE845	SHA256:9175BA77AC91AFDC513CA64788A72BF12915247F64BB1F95C06B5A1938FA4A84
5552	syscrondvr.exe	C:\Users\admin\tbtnds.dat		binary
		MD5:C21598750B95B5529CEAB3890832EF3E	SHA256:D78C503A2C9AD3B4773C7BB04E9392788C0A683A15EC8C9FECD8DF07EC959CC6
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	C:\Users\admin\AppData\Local\Temp\D3EC.exe		executable
		MD5:0EC46393976EB51F307CC11D80BAE845	SHA256:9175BA77AC91AFDC513CA64788A72BF12915247F64BB1F95C06B5A1938FA4A84

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4996	RUXIMICS.exe	GET	200	23.48.23.194:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	GET	200	185.156.72.39:80	http://185.156.72.39/32.exe	unknown	—	—	malicious
4996	RUXIMICS.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1628	D3EC.exe	GET	200	185.156.72.39:80	http://185.156.72.39/newtpp.exe	unknown	—	—	malicious
5552	syscrondvr.exe	GET	—	185.156.72.39:80	http://185.156.72.39/2	unknown	—	—	malicious
5552	syscrondvr.exe	GET	404	185.156.72.39:80	http://185.156.72.39/1	unknown	—	—	malicious
1628	D3EC.exe	GET	200	185.156.72.39:80	http://185.156.72.39/peinstall.php	unknown	—	—	malicious
5552	syscrondvr.exe	GET	200	185.156.72.39:80	http://185.156.72.39/2	unknown	—	—	malicious
5552	syscrondvr.exe	GET	404	185.156.72.39:80	http://185.156.72.39/3	unknown	—	—	malicious
5552	syscrondvr.exe	GET	404	185.156.72.39:80	http://185.156.72.39/4	unknown	—	—	malicious

PID	Process	IP	Domain	ASN	CN	Reputation
4996	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4996	RUXIMICS.exe	23.48.23.194:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	185.156.72.39:80	—	Tov Vaiz Partner	RU	malicious
4996	RUXIMICS.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1628	D3EC.exe	185.156.72.39:80	—	Tov Vaiz Partner	RU	malicious
5552	syscrondvr.exe	185.156.72.39:80	—	Tov Vaiz Partner	RU	malicious
5552	syscrondvr.exe	45.141.233.6:80	—	Euro Crypt EOOD	DE	malicious

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59	whitelisted
google.com	142.250.181.238	whitelisted
crl.microsoft.com	23.48.23.194 23.48.23.179 23.48.23.192 23.48.23.190 23.48.23.181 23.48.23.177 23.48.23.185 23.48.23.191 23.48.23.188	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
www.update.microsoft.com	20.72.235.82	whitelisted

PID	Process	Class	Message
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 34
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	A Network Trojan was detected	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	A Network Trojan was detected	ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
5720	2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer.exe	A Network Trojan was detected	ET MALWARE Possible Malicious Macro DL EXE Feb 2016
1628	D3EC.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host
1628	D3EC.exe	Potential Corporate Privacy Violation	ET INFO PE EXE or DLL Windows file download HTTP
1628	D3EC.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5552	syscrondvr.exe	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Phorpiex CnC Communication
5552	syscrondvr.exe	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Phorpiex CnC Communication

General Info

2025-05-15_aa77925ecf15058d401960a4239117d9_amadey_black-basta_elex_luca-stealer

AA77925ECF15058D401960A4239117D9

DE79B6355A3CA4152E6F6C208EDB370F935CCC4A

F6B5A14DD662F5B0C316952FBF4B0BCDACACD2A7AA53B3C1A669D3877ADEDFD2

6144:oJP8gMxfXHOznNnQlplsnbKSVnopSdXf7VSoj9bU:oJP8gJzNQlplsndVn6Sxbj9bU

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes the autorun value in the registry

PHORPIEX has been detected (SURICATA)

Connects to the CnC server

PHORPIEX has been detected (YARA)

SUSPICIOUS

Reads security settings of Internet Explorer

Executable content was dropped or overwritten

Connects to the server without a host name

Potential Corporate Privacy Violation

Process requests binary or script from the Internet

Starts itself from another location

Contacting a server suspected of hosting an CnC

Connects to unusual port

INFO

Checks proxy server information

Checks supported languages

The sample compiled with english language support

Reads the computer name

Creates files or folders in the user directory

Create files in a temporary directory

Failed to create an executable file in Windows directory

Auto-launch of the file from Registry key

Manual execution by a user

Reads the machine GUID from the registry

Reads the software policy settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings