Overview

overview

10

Static

static

6

cd49c58def...2c.exe

windows7_x64

10

cd49c58def...2c.exe

windows10_x64

10

Analysis

  • max time kernel
    79s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    17/09/2020, 23:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe

  • Size

    2.4MB

  • MD5

    a239735cddd49236ae3562d43d83a8e4

  • SHA1

    35bad8d66c79af9dabdcdd8dcebfc0440efc42a1

  • SHA256

    cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c

  • SHA512

    34bbfc20d82c4227f9e745f0f7cdb5ce68c684a4a84cde0340fa82601f9340fcb7d21c6060564be8580dcba8c3d1b5a16b28ab6964508e0d1ab994b59a818fef

Score
10/10
ransomwaresmaugspyware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\HACKED.txt

Family

smaug

Ransom Note
Your files have been encrypted using military grade encryption. They can never be accessed again without buying a decryption key. You can buy the decryption key at http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion. To access the site you need Tor Browser. Download tor browser here - https://www.torproject.org/download/ . Once you download enter url in tor browser. If you do not know how to buy bitcoin here are options-. https://www.coinbase.com/ , https://paxful.com/ , https://changelly.com/ , or locate a bitcoin ATM like https://www.bitcoindepot.com/ . If you dont buy decryption key or make threats then we will auction your data , passwords, documents, files, ip,router,company server details, along with decryption key via an darkweb auction to highest bidder.,We stay in business because we honor our word. upon payment All your data will remain confidential, and not leaked.
URLs

http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion

https://paxful.com/

https://changelly.com/

https://www.bitcoindepot.com/

Signatures

  • Smaug

    Ransomware-as-a-service first seen marketed on forums etc. in early 2020.

    ransomwaresmaug
  • Drops file in Drivers directory 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops file in System32 directory 356 IoCs
  • Drops file in Program Files directory 11144 IoCs
  • Drops file in Windows directory 13899 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
    "C:\Users\Admin\AppData\Local\Temp\cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:888

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/888-0-0x0000000000400000-0x00000000006A7000-memory.dmp

    Filesize

    2.7MB

    Download