Analysis
-
max time kernel
52s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
16-04-2021 03:19
Static task
static1
Behavioral task
behavioral1
Sample
2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe
Resource
win10v20210408
General
-
Target
2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe
-
Size
125KB
-
MD5
173ab5a59490ea2f66fe37c5e20e05b8
-
SHA1
ac091ce1281a16f9d7766a7853108c612f058c09
-
SHA256
2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21
-
SHA512
0e0d2480fb1bcef185a91d49eb49116dd0fc1837fe634d69451adbdfca00e157495590a59d14409073b0b8b5c96ff3a7f34a7f29976e8fa6cd5aa0b8eedeb05e
Malware Config
Extracted
C:\GANGBANG-NOTE.txt
Jeremyspineberg11@tutanota.com
GeromeSkinggagard1999@tutanota.com
Jeremyspineberg11@protonmail.com
http://corpleaks.net
http://hxt254aygrsziejn.onion
Signatures
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exedescription ioc process File renamed C:\Users\Admin\Pictures\WatchStep.tif => C:\Users\Admin\Pictures\WatchStep.tif.GANGBANG 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File renamed C:\Users\Admin\Pictures\FormatDeny.png => C:\Users\Admin\Pictures\FormatDeny.png.GANGBANG 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened for modification C:\Users\Admin\Pictures\GetWatch.tiff 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File renamed C:\Users\Admin\Pictures\GetWatch.tiff => C:\Users\Admin\Pictures\GetWatch.tiff.GANGBANG 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File renamed C:\Users\Admin\Pictures\ProtectMount.crw => C:\Users\Admin\Pictures\ProtectMount.crw.GANGBANG 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File renamed C:\Users\Admin\Pictures\PublishDisconnect.tiff => C:\Users\Admin\Pictures\PublishDisconnect.tiff.GANGBANG 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File renamed C:\Users\Admin\Pictures\RegisterDismount.crw => C:\Users\Admin\Pictures\RegisterDismount.crw.GANGBANG 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File renamed C:\Users\Admin\Pictures\EnableMeasure.raw => C:\Users\Admin\Pictures\EnableMeasure.raw.GANGBANG 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File renamed C:\Users\Admin\Pictures\ExportPop.crw => C:\Users\Admin\Pictures\ExportPop.crw.GANGBANG 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened for modification C:\Users\Admin\Pictures\PublishDisconnect.tiff 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exedescription ioc process File opened (read-only) \??\B: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\P: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\Q: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\T: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\E: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\F: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\G: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\J: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\M: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\N: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\O: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\V: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\X: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\H: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\I: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\L: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\S: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\Z: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\A: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\K: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\R: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\U: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\W: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe File opened (read-only) \??\Y: 2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe