Analysis
- max time kernel
142s - max time network
152s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
22/09/2021, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe
- Size 749KB
- Sample210922-qlqpeafchp
- SHA256 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2
- MD5 faf21f1f42846fc2bff2db7946354c8c
- SHA1 c2c7a38cb28ab175ac3726bc65e5bf2820990168
- SHA512 4e5ec876c441029769e707ac40087a3815cdaa6becbafbe76a07d758426a1567d95462450b7bd0c0361adf2be5883d4e6b3495bbae45520e01dcd4318ae11ca5
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
vidar
Version
-
40.8
Botnet
-
517
C2
-
https://pavlovoler.tumblr.com/
Attributes
-
profile_id
517
Signatures
- Detected Djvu ransomware 6 IoCs
resource yara_rule behavioral2/memory/3320-115-0x00000000022D0000-0x00000000023EB000-memory.dmp family_djvu behavioral2/memory/3824-116-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3824-117-0x0000000000424141-mapping.dmp family_djvu behavioral2/memory/3824-118-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4516-123-0x0000000000424141-mapping.dmp family_djvu behavioral2/memory/4516-126-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu - Djvu Ransomware
Ransomware which is a variant of the STOP family.
- suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
- Vidar Stealer 4 IoCs
resource yara_rule behavioral2/memory/4612-130-0x0000000000400000-0x00000000004D7000-memory.dmp family_vidar behavioral2/memory/4612-131-0x00000000004A033D-mapping.dmp family_vidar behavioral2/memory/4612-134-0x0000000000400000-0x00000000004D7000-memory.dmp family_vidar behavioral2/memory/4452-133-0x0000000000A00000-0x0000000000AD4000-memory.dmp family_vidar - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 4452 build2.exe 4612 build2.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 4416 icacls.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\5154d771-e710-4713-a570-7166c50dd77a\\2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe\" --AutoStart" 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.2ip.ua 23 api.2ip.ua 4 api.2ip.ua - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3320 set thread context of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 4300 set thread context of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4452 set thread context of 4612 4452 build2.exe 78 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3108 4612 WerFault.exe 78 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3824 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 3824 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 4516 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 4516 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe 3108 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3108 WerFault.exe Token: SeBackupPrivilege 3108 WerFault.exe Token: SeDebugPrivilege 3108 WerFault.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3320 wrote to memory of 3824 3320 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 70 PID 3824 wrote to memory of 4416 3824 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 73 PID 3824 wrote to memory of 4416 3824 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 73 PID 3824 wrote to memory of 4416 3824 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 73 PID 3824 wrote to memory of 4300 3824 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 74 PID 3824 wrote to memory of 4300 3824 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 74 PID 3824 wrote to memory of 4300 3824 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 74 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4300 wrote to memory of 4516 4300 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 76 PID 4516 wrote to memory of 4452 4516 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 77 PID 4516 wrote to memory of 4452 4516 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 77 PID 4516 wrote to memory of 4452 4516 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe 77 PID 4452 wrote to memory of 4612 4452 build2.exe 78 PID 4452 wrote to memory of 4612 4452 build2.exe 78 PID 4452 wrote to memory of 4612 4452 build2.exe 78 PID 4452 wrote to memory of 4612 4452 build2.exe 78 PID 4452 wrote to memory of 4612 4452 build2.exe 78 PID 4452 wrote to memory of 4612 4452 build2.exe 78 PID 4452 wrote to memory of 4612 4452 build2.exe 78 PID 4452 wrote to memory of 4612 4452 build2.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe"C:\Users\Admin\AppData\Local\Temp\2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe"C:\Users\Admin\AppData\Local\Temp\2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\5154d771-e710-4713-a570-7166c50dd77a" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:4416
-
-
C:\Users\Admin\AppData\Local\Temp\2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe"C:\Users\Admin\AppData\Local\Temp\2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe"C:\Users\Admin\AppData\Local\Temp\2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\bd066708-226b-4e83-b9b4-36dba2e6a979\build2.exe"C:\Users\Admin\AppData\Local\bd066708-226b-4e83-b9b4-36dba2e6a979\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\bd066708-226b-4e83-b9b4-36dba2e6a979\build2.exe"C:\Users\Admin\AppData\Local\bd066708-226b-4e83-b9b4-36dba2e6a979\build2.exe"6⤵
- Executes dropped EXE
PID:4612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 10887⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
-
-
-
-