Analysis

  • max time kernel
    2s
  • max time network
    3s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    10-12-2020 18:39

General

  • Target

    c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exe

  • Size

    3.0MB

  • MD5

    1441e78b9e6ce78dd02e7491b25e7f9e

  • SHA1

    8c355fd0e062152a403cb0c42412850b60524aac

  • SHA256

    c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e

  • SHA512

    52e34a8ea136783e2009700b330e7db32e817ab0420c77e6cf47ab79c385635036ac4b547d6d1ee7542eb1e2e0b88f741289b96bf66dde18f1fdd03cb554d023

Score
10/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\INFECTION-HELP.txt

Ransom Note
Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: christopherlampar1990@tutanota.com rodtherry1985@tutanota.com lewisldupre@protonmail.com
Emails

christopherlampar1990@tutanota.com

rodtherry1985@tutanota.com

lewisldupre@protonmail.com

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Signatures

  • Drops desktop.ini file(s) 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exe"
    1⤵
    • Drops desktop.ini file(s)
    PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini
    MD5

    2695f9db0d05983718cb673b2d1a61e3

    SHA1

    db942bf0fe4758fa9bd8f983ea6a03a88fbff174

    SHA256

    c86d7f85acd1e03d25a41c01da21ed70c6dd089b5b697778d1500a68feebb7c5

    SHA512

    019c125862a62db6abe3f41a8bd537a77dfacf27038123322a960af13ae77f2f5fa4c9808796447315873d78c232fb8faa0cc8fa40d046e9b668f7c89c7c6874

  • memory/1080-2-0x0000000000400000-0x0000000000745000-memory.dmp
    Filesize

    3.3MB

  • memory/1080-3-0x0000000000400000-0x0000000000745000-memory.dmp
    Filesize

    3.3MB

  • memory/1080-4-0x0000000000400000-0x0000000000745000-memory.dmp
    Filesize

    3.3MB