djvu | b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a

Analysis

max time kernel
78s
max time network
142s
platform
windows10_x64
resource
win10v20210408
submitted
03/09/2021, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe
Size 781KB
Sample210903-k2rnragacp
SHA256 b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a
MD5 1722ac41d4716258e295807cda56d9bd
SHA1 aac532018ca8c9f9d6f34de4e82f9f45d00ca8f5
SHA512 9e69b1e8c623bdb6b6f8819534531ad450e938918fdba9a3cd5cabc238dad9fc99a15a292ccf8ff273221b19c4a3f11fe0acd0aea88197c1be3d565e391d8e65
MD5 SHA1 SHA512

Score

10^/10

djvu vidar 517 discovery persistence ransomware stealer suricata

Malware Config

Extracted

Family

vidar

Version

40.4

Botnet

https://romkaxarit.tumblr.com/

Attributes

profile_id
517

Signatures

Detected Djvu ransomeware 6 IoCs

resource	yara_rule
behavioral2/memory/3900-114-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3900-115-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/568-116-0x00000000025D0000-0x00000000026EB000-memory.dmp	family_djvu
behavioral2/memory/3900-117-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3468-122-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/3468-127-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/3760-131-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar
behavioral2/memory/3760-132-0x000000000049ECBD-mapping.dmp	family_vidar
behavioral2/memory/2172-134-0x0000000004920000-0x00000000049F3000-memory.dmp	family_vidar
behavioral2/memory/3760-135-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2172	build2.exe
3760	build2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
728	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f0ea63b8-713a-438f-b671-8e8ac8c25718\\b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe\" --AutoStart"	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	api.2ip.ua
11	api.2ip.ua
12	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 568 set thread context of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 2964 set thread context of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2172 set thread context of 3760	2172	build2.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1004	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
756	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3900	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe
3900	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe
3468	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe
3468	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	taskkill.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 568 wrote to memory of 3900	568	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	75
PID 3900 wrote to memory of 728	3900	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	76
PID 3900 wrote to memory of 728	3900	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	76
PID 3900 wrote to memory of 728	3900	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	76
PID 3900 wrote to memory of 2964	3900	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	77
PID 3900 wrote to memory of 2964	3900	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	77
PID 3900 wrote to memory of 2964	3900	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	77
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 2964 wrote to memory of 3468	2964	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	79
PID 3468 wrote to memory of 2172	3468	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	82
PID 3468 wrote to memory of 2172	3468	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	82
PID 3468 wrote to memory of 2172	3468	b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe	82
PID 2172 wrote to memory of 3760	2172	build2.exe	84
PID 2172 wrote to memory of 3760	2172	build2.exe	84
PID 2172 wrote to memory of 3760	2172	build2.exe	84
PID 2172 wrote to memory of 3760	2172	build2.exe	84
PID 2172 wrote to memory of 3760	2172	build2.exe	84
PID 2172 wrote to memory of 3760	2172	build2.exe	84
PID 2172 wrote to memory of 3760	2172	build2.exe	84
PID 2172 wrote to memory of 3760	2172	build2.exe	84
PID 564 wrote to memory of 756	564	cmd.exe	87
PID 564 wrote to memory of 756	564	cmd.exe	87
PID 564 wrote to memory of 756	564	cmd.exe	87
PID 564 wrote to memory of 1004	564	cmd.exe	88
PID 564 wrote to memory of 1004	564	cmd.exe	88
PID 564 wrote to memory of 1004	564	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe
"C:\Users\Admin\AppData\Local\Temp\b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:568
- C:\Users\Admin\AppData\Local\Temp\b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe
  "C:\Users\Admin\AppData\Local\Temp\b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\f0ea63b8-713a-438f-b671-8e8ac8c25718" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:728
- - C:\Users\Admin\AppData\Local\Temp\b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe
    "C:\Users\Admin\AppData\Local\Temp\b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe
      "C:\Users\Admin\AppData\Local\Temp\b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Users\Admin\AppData\Local\671b2dfc-111c-4c26-abd4-d3da3ba737d2\build2.exe
        
        "C:\Users\Admin\AppData\Local\671b2dfc-111c-4c26-abd4-d3da3ba737d2\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2172
      - C:\Users\Admin\AppData\Local\671b2dfc-111c-4c26-abd4-d3da3ba737d2\build2.exe
        
        "C:\Users\Admin\AppData\Local\671b2dfc-111c-4c26-abd4-d3da3ba737d2\build2.exe"
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\671b2dfc-111c-4c26-abd4-d3da3ba737d2\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-116-0x00000000025D0000-0x00000000026EB000-memory.dmp

Download

memory/2172-134-0x0000000004920000-0x00000000049F3000-memory.dmp

Download

memory/3468-127-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3760-135-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/3760-131-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/3900-117-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3900-114-0x0000000000400000-0x0000000000537000-memory.dmp

Download