Resubmissions
25/03/2025, 15:40
250325-s4pk6ssjz3 1005/02/2025, 09:14
250205-k7s4rszmex 1026/08/2021, 08:49
210826-epqpjsdkt2 10Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26/08/2021, 08:49
Static task
static1
Behavioral task
behavioral1
Sample
9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe
-
Size
174KB
-
MD5
badcc5eeb093cfa468ac2433ca3ec639
-
SHA1
1e9b7c068262b69803f40088d7c296ec1cad777c
-
SHA256
9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd
-
SHA512
9710efb850d7109bbb51a769ecf610e1c79732d331c140392b68448f3fca49249b1458cbf7e4e931056bc4987a605616052197f1003c68d0490f66ab6e25c611
Malware Config
Extracted
Path
C:\How To Restore Your Files.txt
Ransom Note
Hi, friend.
Your files are encrypted. And you can't do anything with them. If you want to restore them, contact us via telegram @username312321
Price - 350 $
You can pay with BTC - bc1qd53hpk76zutapw8tsgnnkeuuuhuk4ecr2wrd93
Wallets
bc1qd53hpk76zutapw8tsgnnkeuuuhuk4ecr2wrd93
Extracted
Family
smokeloader
Version
2020
C2
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 2696 BA8B.exe 2692 AudioB.exe 3152 AudioB.exe -
Modifies extensions of user files 16 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\MeasureWait.raw => C:\Users\Admin\Pictures\MeasureWait.raw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\SearchInstall.tiff AudioB.exe File opened for modification C:\Users\Admin\Pictures\BlockComplete.tiff AudioB.exe File renamed C:\Users\Admin\Pictures\DebugUpdate.png => C:\Users\Admin\Pictures\DebugUpdate.png.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\MeasureWait.raw.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\PushRequest.png.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\SkipConfirm.png => C:\Users\Admin\Pictures\SkipConfirm.png.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\DebugUpdate.png.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\MoveUnregister.png.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\PushRequest.png => C:\Users\Admin\Pictures\PushRequest.png.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\SearchInstall.tiff => C:\Users\Admin\Pictures\SearchInstall.tiff.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\BlockComplete.tiff => C:\Users\Admin\Pictures\BlockComplete.tiff.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\BlockComplete.tiff.babyk AudioB.exe File renamed C:\Users\Admin\Pictures\MoveUnregister.png => C:\Users\Admin\Pictures\MoveUnregister.png.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\SearchInstall.tiff.babyk AudioB.exe File opened for modification C:\Users\Admin\Pictures\SkipConfirm.png.babyk AudioB.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BA8B.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BA8B.exe -
Deletes itself 1 IoCs
pid Process 3040 Process not Found -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000600000001ab80-118.dat themida behavioral1/files/0x000600000001ab80-119.dat themida behavioral1/memory/2696-122-0x0000000000AB0000-0x0000000000AB1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BA8B.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: AudioB.exe File opened (read-only) \??\E: AudioB.exe File opened (read-only) \??\R: AudioB.exe File opened (read-only) \??\O: AudioB.exe File opened (read-only) \??\H: AudioB.exe File opened (read-only) \??\N: AudioB.exe File opened (read-only) \??\W: AudioB.exe File opened (read-only) \??\I: AudioB.exe File opened (read-only) \??\P: AudioB.exe File opened (read-only) \??\S: AudioB.exe File opened (read-only) \??\L: AudioB.exe File opened (read-only) \??\Z: AudioB.exe File opened (read-only) \??\X: AudioB.exe File opened (read-only) \??\V: AudioB.exe File opened (read-only) \??\T: AudioB.exe File opened (read-only) \??\F: AudioB.exe File opened (read-only) \??\J: AudioB.exe File opened (read-only) \??\K: AudioB.exe File opened (read-only) \??\M: Process not Found File opened (read-only) \??\B: AudioB.exe File opened (read-only) \??\M: AudioB.exe File opened (read-only) \??\Y: AudioB.exe File opened (read-only) \??\U: AudioB.exe File opened (read-only) \??\A: AudioB.exe File opened (read-only) \??\G: AudioB.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2696 BA8B.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2692 set thread context of 3152 2692 AudioB.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3148 vssadmin.exe 2192 vssadmin.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2256 9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe 2256 9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found 3040 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3040 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2256 9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeDebugPrivilege 2696 BA8B.exe Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeDebugPrivilege 2692 AudioB.exe Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeBackupPrivilege 2496 vssvc.exe Token: SeRestorePrivilege 2496 vssvc.exe Token: SeAuditPrivilege 2496 vssvc.exe Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found Token: SeShutdownPrivilege 3040 Process not Found Token: SeCreatePagefilePrivilege 3040 Process not Found -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3040 Process not Found 3040 Process not Found 3040 Process not Found -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3040 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3040 Process not Found -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2696 3040 Process not Found 79 PID 3040 wrote to memory of 2696 3040 Process not Found 79 PID 3040 wrote to memory of 2696 3040 Process not Found 79 PID 2696 wrote to memory of 2692 2696 BA8B.exe 82 PID 2696 wrote to memory of 2692 2696 BA8B.exe 82 PID 2696 wrote to memory of 2692 2696 BA8B.exe 82 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 2692 wrote to memory of 3152 2692 AudioB.exe 83 PID 3152 wrote to memory of 2380 3152 AudioB.exe 84 PID 3152 wrote to memory of 2380 3152 AudioB.exe 84 PID 2380 wrote to memory of 3148 2380 cmd.exe 86 PID 2380 wrote to memory of 3148 2380 cmd.exe 86 PID 3152 wrote to memory of 3628 3152 AudioB.exe 90 PID 3152 wrote to memory of 3628 3152 AudioB.exe 90 PID 3628 wrote to memory of 2192 3628 cmd.exe 92 PID 3628 wrote to memory of 2192 3628 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe"C:\Users\Admin\AppData\Local\Temp\9528313d13ec6629a64434c36e11872cc12f35232908b2a2e6a89636a199d6cd.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2256
-
C:\Users\Admin\AppData\Local\Temp\BA8B.exeC:\Users\Admin\AppData\Local\Temp\BA8B.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\AudioB.exe"C:\Users\Admin\AppData\Local\Temp\AudioB.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\AudioB.exe"C:\Users\Admin\AppData\Local\Temp\AudioB.exe"3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:3148
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:2192
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496