Overview

overview

10

Static

static

6

cd49c58def...2c.exe

windows7_x64

10

cd49c58def...2c.exe

windows10_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    17/09/2020, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
  • Size 2.4MB
  • Sample200917-hl1flta176
  • SHA256 cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c
  • MD5 SHA1 SHA512
Score
10/10
ransomwaresmaugspyware

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\HACKED.txt

  • smaug

Ransom Note
  • Your files have been encrypted using military grade encryption. They can never be accessed again without buying a decryption key. You can buy the decryption key at http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion. To access the site you need Tor Browser. Download tor browser here - https://www.torproject.org/download/ . Once you download enter url in tor browser. If you do not know how to buy bitcoin here are options-. https://www.coinbase.com/ , https://paxful.com/ , https://changelly.com/ , or locate a bitcoin ATM like https://www.bitcoindepot.com/ . If you dont buy decryption key or make threats then we will auction your data , passwords, documents, files, ip,router,company server details, along with decryption key via an darkweb auction to highest bidder.,We stay in business because we honor our word. upon payment All your data will remain confidential, and not leaked.
URLs

  • http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion

  • https://paxful.com/

  • https://changelly.com/

  • https://www.bitcoindepot.com/

Signatures

  • Smaug

    Ransomware-as-a-service first seen marketed on forums etc. in early 2020.

    ransomwaresmaug
  • Drops file in Drivers directory 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops file in System32 directory 356 IoCs
  • Drops file in Program Files directory 11142 IoCs
  • Drops file in Windows directory 13899 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
    "C:\Users\Admin\AppData\Local\Temp\cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:3056

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3056-0-0x0000000000400000-0x00000000006A7000-memory.dmp
        Download