Overview
overview
10Static
static
10ฺฺฺà...ฺฺ
windows10_x64
ฺฺฺà...ฺฺ
windows10_x64
ฺฺฺà...ฺฺ
windows10_x64
8ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
7ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
1ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
8ฺฺฺà...ฺฺ
windows10_x64
1ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
8ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
9ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
8ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
5ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
8ฺฺฺà...ฺฺ
windows10_x64
10Resubmissions
24-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 1024-07-2023 06:25
230724-g6s6laag35 1022-07-2023 15:57
230722-tee6wabg5w 1020-07-2023 23:19
230720-3bb5gsbf5v 1020-07-2023 23:06
230720-23f23sba63 1003-02-2021 11:43
210203-6bgge2nfan 1022-11-2020 06:42
201122-6x1at779dj 10Analysis
-
max time kernel
306s -
max time network
311s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-02-2021 11:43
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@000.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Endermanch@7ev3n.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Endermanch@AnViPC2009.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Endermanch@Antivirus.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Endermanch@AntivirusPlatinum.exe
Resource
win10v20201028
Behavioral task
behavioral6
Sample
Endermanch@AntivirusPro2017.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
Endermanch@BadRabbit.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
Endermanch@Birele.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
Endermanch@Cerber5.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
Endermanch@CleanThis.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
Endermanch@ColorBug.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
Endermanch@DeriaLock.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Endermanch@Deskbottom.exe
Resource
win10v20201028
Behavioral task
behavioral14
Sample
Endermanch@DesktopPuzzle.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
Endermanch@HMBlocker.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
Endermanch@HappyAntivirus.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
Endermanch@Illerka.C.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
Endermanch@Koteyka2.exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
Endermanch@LPS2019.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
Endermanch@Movie.mpeg.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
Endermanch@NavaShield(1).exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
Endermanch@NavaShield.exe
Resource
win10v20201028
Behavioral task
behavioral26
Sample
Endermanch@PCDefender.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
Endermanch@PCDefenderv2.msi
Resource
win10v20201028
Behavioral task
behavioral28
Sample
Endermanch@PolyRansom.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
Endermanch@PowerPoint.exe
Resource
win10v20201028
Behavioral task
behavioral30
Sample
Endermanch@ProgramOverflow.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
Endermanch@RegistrySmart.exe
Resource
win10v20201028
Behavioral task
behavioral32
Sample
Endermanch@SE2011.exe
Resource
win10v20201028
General
-
Target
Endermanch@FreeYoutubeDownloader.exe
-
Size
396KB
-
MD5
13f4b868603cf0dd6c32702d1bd858c9
-
SHA1
a595ab75e134f5616679be5f11deefdfaae1de15
-
SHA256
cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
-
SHA512
e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Executes dropped EXE 4 IoCs
Processes:
Free YouTube Downloader.exeB094.tmpBox.exeBox.exepid process 2988 Free YouTube Downloader.exe 736 B094.tmp 2200 Box.exe 3260 Box.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ClosePing.tiff rundll32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Endermanch@FreeYoutubeDownloader.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Endermanch@FreeYoutubeDownloader.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe" Endermanch@FreeYoutubeDownloader.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Windows directory 8 IoCs
Processes:
Endermanch@FreeYoutubeDownloader.exerundll32.exedescription ioc process File created C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini Endermanch@FreeYoutubeDownloader.exe File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\B094.tmp rundll32.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe Endermanch@FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe Endermanch@FreeYoutubeDownloader.exe File opened for modification C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe Endermanch@FreeYoutubeDownloader.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3596 schtasks.exe 1580 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
rundll32.exeB094.tmppid process 64 rundll32.exe 64 rundll32.exe 64 rundll32.exe 64 rundll32.exe 736 B094.tmp 736 B094.tmp 736 B094.tmp 736 B094.tmp 736 B094.tmp 736 B094.tmp 64 rundll32.exe 64 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rundll32.exeB094.tmpdescription pid process Token: SeShutdownPrivilege 64 rundll32.exe Token: SeDebugPrivilege 64 rundll32.exe Token: SeTcbPrivilege 64 rundll32.exe Token: SeDebugPrivilege 736 B094.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Free YouTube Downloader.exepid process 2988 Free YouTube Downloader.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Free YouTube Downloader.exepid process 2988 Free YouTube Downloader.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
Endermanch@FreeYoutubeDownloader.exerundll32.exerundll32.execmd.execmd.execmd.exeFree YouTube Downloader.exedescription pid process target process PID 3636 wrote to memory of 2988 3636 Endermanch@FreeYoutubeDownloader.exe Free YouTube Downloader.exe PID 3636 wrote to memory of 2988 3636 Endermanch@FreeYoutubeDownloader.exe Free YouTube Downloader.exe PID 3392 wrote to memory of 64 3392 rundll32.exe rundll32.exe PID 3392 wrote to memory of 64 3392 rundll32.exe rundll32.exe PID 3392 wrote to memory of 64 3392 rundll32.exe rundll32.exe PID 64 wrote to memory of 2072 64 rundll32.exe cmd.exe PID 64 wrote to memory of 2072 64 rundll32.exe cmd.exe PID 64 wrote to memory of 2072 64 rundll32.exe cmd.exe PID 2072 wrote to memory of 3812 2072 cmd.exe schtasks.exe PID 2072 wrote to memory of 3812 2072 cmd.exe schtasks.exe PID 2072 wrote to memory of 3812 2072 cmd.exe schtasks.exe PID 64 wrote to memory of 2568 64 rundll32.exe cmd.exe PID 64 wrote to memory of 2568 64 rundll32.exe cmd.exe PID 64 wrote to memory of 2568 64 rundll32.exe cmd.exe PID 64 wrote to memory of 3972 64 rundll32.exe cmd.exe PID 64 wrote to memory of 3972 64 rundll32.exe cmd.exe PID 64 wrote to memory of 3972 64 rundll32.exe cmd.exe PID 64 wrote to memory of 736 64 rundll32.exe B094.tmp PID 64 wrote to memory of 736 64 rundll32.exe B094.tmp PID 2568 wrote to memory of 3596 2568 cmd.exe schtasks.exe PID 2568 wrote to memory of 3596 2568 cmd.exe schtasks.exe PID 2568 wrote to memory of 3596 2568 cmd.exe schtasks.exe PID 3972 wrote to memory of 1580 3972 cmd.exe schtasks.exe PID 3972 wrote to memory of 1580 3972 cmd.exe schtasks.exe PID 3972 wrote to memory of 1580 3972 cmd.exe schtasks.exe PID 2988 wrote to memory of 2200 2988 Free YouTube Downloader.exe Box.exe PID 2988 wrote to memory of 2200 2988 Free YouTube Downloader.exe Box.exe PID 2988 wrote to memory of 2200 2988 Free YouTube Downloader.exe Box.exe PID 2988 wrote to memory of 3260 2988 Free YouTube Downloader.exe Box.exe PID 2988 wrote to memory of 3260 2988 Free YouTube Downloader.exe Box.exe PID 2988 wrote to memory of 3260 2988 Free YouTube Downloader.exe Box.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@FreeYoutubeDownloader.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@FreeYoutubeDownloader.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"3⤵
- Executes dropped EXE
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 151⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Modifies extensions of user files
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4042766786 && exit"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4042766786 && exit"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:01:003⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:01:004⤵
- Creates scheduled task(s)
-
C:\Windows\B094.tmp"C:\Windows\B094.tmp" \\.\pipe\{52CE986F-4B10-49EF-9E03-4BC3E341382A}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\B094.tmpMD5
347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
C:\Windows\B094.tmpMD5
347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exeMD5
1bb4dd43a8aebc8f3b53acd05e31d5b5
SHA154cd1a4a505b301df636903b2293d995d560887e
SHA256a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02
SHA51294c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exeMD5
1bb4dd43a8aebc8f3b53acd05e31d5b5
SHA154cd1a4a505b301df636903b2293d995d560887e
SHA256a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02
SHA51294c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exeMD5
1bb4dd43a8aebc8f3b53acd05e31d5b5
SHA154cd1a4a505b301df636903b2293d995d560887e
SHA256a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02
SHA51294c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exeMD5
f33a4e991a11baf336a2324f700d874d
SHA19da1891a164f2fc0a88d0de1ba397585b455b0f4
SHA256a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7
SHA512edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exeMD5
f33a4e991a11baf336a2324f700d874d
SHA19da1891a164f2fc0a88d0de1ba397585b455b0f4
SHA256a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7
SHA512edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20
-
memory/64-11-0x00000000036C0000-0x0000000003728000-memory.dmpFilesize
416KB
-
memory/64-10-0x0000000000000000-mapping.dmp
-
memory/736-16-0x0000000000000000-mapping.dmp
-
memory/1580-20-0x0000000000000000-mapping.dmp
-
memory/2072-12-0x0000000000000000-mapping.dmp
-
memory/2200-29-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/2200-31-0x0000000005203000-0x0000000005205000-memory.dmpFilesize
8KB
-
memory/2200-24-0x0000000073280000-0x000000007396E000-memory.dmpFilesize
6MB
-
memory/2200-28-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/2200-30-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/2200-27-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/2200-22-0x0000000000000000-mapping.dmp
-
memory/2200-25-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/2568-14-0x0000000000000000-mapping.dmp
-
memory/2988-6-0x000001EF4D100000-0x000001EF4D101000-memory.dmpFilesize
4KB
-
memory/2988-2-0x0000000000000000-mapping.dmp
-
memory/2988-8-0x000001EF4EE20000-0x000001EF4EE22000-memory.dmpFilesize
8KB
-
memory/2988-9-0x000001EF4EE22000-0x000001EF4EE24000-memory.dmpFilesize
8KB
-
memory/2988-5-0x00007FFB8A380000-0x00007FFB8AD6C000-memory.dmpFilesize
9MB
-
memory/3260-32-0x0000000000000000-mapping.dmp
-
memory/3260-34-0x0000000073280000-0x000000007396E000-memory.dmpFilesize
6MB
-
memory/3260-40-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/3260-41-0x0000000005333000-0x0000000005335000-memory.dmpFilesize
8KB
-
memory/3596-17-0x0000000000000000-mapping.dmp
-
memory/3812-13-0x0000000000000000-mapping.dmp
-
memory/3972-15-0x0000000000000000-mapping.dmp