Analysis
- max time kernel
146s - max time network
147s - platform
windows10_x64 - resource
win10v20210408 - submitted
22/09/2021, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe
- Size 763KB
- Sample210922-qlqdmsfchm
- SHA256 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f
- MD5 42641148d169c91748209ac49b18cdd6
- SHA1 815394e3e3fe21a9f3103446c558496571a5ad31
- SHA512 7e4f51f595fca664e52f18f40c9f19ba08f66eb11ffb2b594040cf3b3ffbf4efc18be33023e021a978884e30f8885834ce0632312664055ec8c1cea7699d6d02
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
vidar
Version
-
40.8
Botnet
-
517
C2
-
https://pavlovoler.tumblr.com/
Attributes
-
profile_id
517
Signatures
- Detected Djvu ransomware 6 IoCs
resource yara_rule behavioral2/memory/740-114-0x0000000000AF0000-0x0000000000C0B000-memory.dmp family_djvu behavioral2/memory/856-115-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/856-116-0x0000000000424141-mapping.dmp family_djvu behavioral2/memory/856-117-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3128-122-0x0000000000424141-mapping.dmp family_djvu behavioral2/memory/3128-127-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu - Djvu Ransomware
Ransomware which is a variant of the STOP family.
- suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
- Vidar Stealer 4 IoCs
resource yara_rule behavioral2/memory/1832-131-0x0000000000400000-0x00000000004D7000-memory.dmp family_vidar behavioral2/memory/1832-132-0x00000000004A033D-mapping.dmp family_vidar behavioral2/memory/3948-134-0x00000000009D0000-0x0000000000AA4000-memory.dmp family_vidar behavioral2/memory/1832-135-0x0000000000400000-0x00000000004D7000-memory.dmp family_vidar - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 3948 build2.exe 1832 build2.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 1284 icacls.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a489e1c0-9d73-43cf-bdb1-44216b65532f\\8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe\" --AutoStart" 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.2ip.ua 3 api.2ip.ua 13 api.2ip.ua - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 740 set thread context of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 1508 set thread context of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 3948 set thread context of 1832 3948 build2.exe 76 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 1640 1832 WerFault.exe 76 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 856 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 856 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 3128 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 3128 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe 1640 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1640 WerFault.exe Token: SeBackupPrivilege 1640 WerFault.exe Token: SeDebugPrivilege 1640 WerFault.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 740 wrote to memory of 856 740 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 68 PID 856 wrote to memory of 1284 856 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 69 PID 856 wrote to memory of 1284 856 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 69 PID 856 wrote to memory of 1284 856 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 69 PID 856 wrote to memory of 1508 856 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 70 PID 856 wrote to memory of 1508 856 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 70 PID 856 wrote to memory of 1508 856 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 70 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 1508 wrote to memory of 3128 1508 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 74 PID 3128 wrote to memory of 3948 3128 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 75 PID 3128 wrote to memory of 3948 3128 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 75 PID 3128 wrote to memory of 3948 3128 8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe 75 PID 3948 wrote to memory of 1832 3948 build2.exe 76 PID 3948 wrote to memory of 1832 3948 build2.exe 76 PID 3948 wrote to memory of 1832 3948 build2.exe 76 PID 3948 wrote to memory of 1832 3948 build2.exe 76 PID 3948 wrote to memory of 1832 3948 build2.exe 76 PID 3948 wrote to memory of 1832 3948 build2.exe 76 PID 3948 wrote to memory of 1832 3948 build2.exe 76 PID 3948 wrote to memory of 1832 3948 build2.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe"C:\Users\Admin\AppData\Local\Temp\8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe"C:\Users\Admin\AppData\Local\Temp\8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\a489e1c0-9d73-43cf-bdb1-44216b65532f" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:1284
-
-
C:\Users\Admin\AppData\Local\Temp\8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe"C:\Users\Admin\AppData\Local\Temp\8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe"C:\Users\Admin\AppData\Local\Temp\8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\4058641f-eba1-4ff7-9c2d-d80aa3d07343\build2.exe"C:\Users\Admin\AppData\Local\4058641f-eba1-4ff7-9c2d-d80aa3d07343\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\4058641f-eba1-4ff7-9c2d-d80aa3d07343\build2.exe"C:\Users\Admin\AppData\Local\4058641f-eba1-4ff7-9c2d-d80aa3d07343\build2.exe"6⤵
- Executes dropped EXE
PID:1832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 10807⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
-
-
-
-