c7c2bb08529df1ea16244dfed79a60c039426c69823ee24731213011460ee82d

General

Target

123.exe
Size

9.3MB
MD5

49e1e065b2d619c84ce34f2bf5b04105
SHA1

3b4c8300fcc847c715a6f8d9606c3daabfa9365d
SHA256

c7c2bb08529df1ea16244dfed79a60c039426c69823ee24731213011460ee82d
SHA512

d28e8663ee08923b0b4ba8729329bd25ca054db648f3fb43aa037e1cc87e725954450f5d132457dc506836f03d8c5faa3c2031b2624a7be011037179e6ef06b1

Score

10^/10

evasion ransomware spyware stealer themida trojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@LegionReadMe@.txt

Ransom Note

Ooops! All your important files are encrypted! What happend to my computer? All your important files are encrypted. No one can help you to restore files without our special decryptor Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is at the bottom of the sheet) and attach 4-5 encrypted files. You have to pay $120 in bitcoin to decrypt other files. How to contact us? 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us (CobraLocker@mail2tor.com) What if i have already paid? Send your Bitcoin wallet ID to e-mail provided above P.S. Do not modify encrypted files Our bitcoin address 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

Emails

CobraLocker@mail2tor.com

Wallets

131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

URLs

http://mail2tor2zyjdctd.onion/

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

123.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RemoveConvertFrom.raw => C:\Users\Admin\Pictures\RemoveConvertFrom.raw.Legion	123.exe
File renamed	C:\Users\Admin\Pictures\RevokeDeny.crw => C:\Users\Admin\Pictures\RevokeDeny.crw.Legion	123.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

123.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	123.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	123.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/3952-116-0x00000000011F0000-0x00000000011F1000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

123.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 123.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	123.exe

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

123.exe

pid process

3952 123.exe

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
2192	vssadmin.exe
2328	vssadmin.exe
2772	vssadmin.exe
3968	vssadmin.exe
3728	vssadmin.exe
2248	vssadmin.exe
2720	vssadmin.exe
2144	vssadmin.exe
3452	vssadmin.exe
3848	vssadmin.exe
1000	vssadmin.exe
3256	vssadmin.exe
3788	vssadmin.exe
3140	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

123.exe

pid	process
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe
3952	123.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

123.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3952	123.exe
Token: SeBackupPrivilege	2932	vssvc.exe
Token: SeRestorePrivilege	2932	vssvc.exe
Token: SeAuditPrivilege	2932	vssvc.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

123.execmd.exe

description	pid	process	target process
PID 3952 wrote to memory of 2804	3952	123.exe	cmd.exe
PID 3952 wrote to memory of 2804	3952	123.exe	cmd.exe
PID 3952 wrote to memory of 2804	3952	123.exe	cmd.exe
PID 2804 wrote to memory of 3728	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3728	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3728	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2248	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2248	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2248	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2192	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2192	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2192	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3452	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3452	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3452	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2720	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2720	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2720	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3256	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3256	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3256	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3848	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3848	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3848	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2144	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2144	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2144	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3788	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3788	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3788	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 1000	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 1000	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 1000	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3140	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3140	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3140	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2328	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2328	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2328	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2772	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2772	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 2772	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3968	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3968	2804	cmd.exe	vssadmin.exe
PID 2804 wrote to memory of 3968	2804	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\123.exe
"C:\Users\Admin\AppData\Local\Temp\123.exe"
1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WTHBNZD.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\vssadmin.exe
vssadmin Delete Shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3728

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
3⤵
- Interacts with shadow copies
PID:2248

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
3⤵
- Interacts with shadow copies
PID:2192

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3452

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2720

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3256

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3848

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2144

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3788

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1000

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3140

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2328

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2772

C:\Windows\SysWOW64\vssadmin.exe
vssadmin Delete Shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2932

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WTHBNZD.bat
MD5
d2aba3e1af80edd77e206cd43cfd3129

SHA1
3116da65d097708fad63a3b73d1c39bffa94cb01

SHA256
8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

SHA512
0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

Download Submit
memory/1000-134-0x0000000000000000-mapping.dmp

Download
memory/2144-132-0x0000000000000000-mapping.dmp

Download
memory/2192-126-0x0000000000000000-mapping.dmp

Download
memory/2248-125-0x0000000000000000-mapping.dmp

Download
memory/2328-136-0x0000000000000000-mapping.dmp

Download
memory/2720-129-0x0000000000000000-mapping.dmp

Download
memory/2772-137-0x0000000000000000-mapping.dmp

Download
memory/2804-122-0x0000000000000000-mapping.dmp

Download
memory/3140-135-0x0000000000000000-mapping.dmp

Download
memory/3256-130-0x0000000000000000-mapping.dmp

Download
memory/3452-128-0x0000000000000000-mapping.dmp

Download
memory/3728-124-0x0000000000000000-mapping.dmp

Download
memory/3788-133-0x0000000000000000-mapping.dmp

Download
memory/3848-131-0x0000000000000000-mapping.dmp

Download
memory/3952-121-0x0000000005F80000-0x0000000005F81000-memory.dmp

Filesize
4KB

Download
memory/3952-120-0x0000000005FA0000-0x000000000649E000-memory.dmp

Filesize
5.0MB

Download
memory/3952-127-0x0000000005FA0000-0x000000000649E000-memory.dmp

Filesize
5.0MB

Download
memory/3952-119-0x0000000006040000-0x0000000006041000-memory.dmp

Filesize
4KB

Download
memory/3952-114-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/3952-118-0x00000000064A0000-0x00000000064A1000-memory.dmp

Filesize
4KB

Download
memory/3952-116-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/3952-139-0x0000000005FA0000-0x000000000649E000-memory.dmp

Filesize
5.0MB

Download
memory/3968-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads