Overview
overview
10Static
static
BS.exe
windows7_x64
10BS.exe
windows10_x64
10BuildS.exe
windows7_x64
10BuildS.exe
windows10_x64
10READS.exe
windows7_x64
10READS.exe
windows10_x64
10baseus_nowin.exe
windows7_x64
10baseus_nowin.exe
windows10_x64
10rbs.exe
windows7_x64
10rbs.exe
windows10_x64
10scan.exe
windows7_x64
1scan.exe
windows10_x64
1Analysis
-
max time kernel
161s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 09:41
Static task
static1
Behavioral task
behavioral1
Sample
BS.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
BS.exe
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
BuildS.exe
Resource
win7-en-20210920
Behavioral task
behavioral4
Sample
BuildS.exe
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
READS.exe
Resource
win7-en-20210920
Behavioral task
behavioral6
Sample
READS.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
baseus_nowin.exe
Resource
win7-en-20210920
Behavioral task
behavioral8
Sample
baseus_nowin.exe
Resource
win10-en-20210920
Behavioral task
behavioral9
Sample
rbs.exe
Resource
win7-en-20211014
Behavioral task
behavioral10
Sample
rbs.exe
Resource
win10-en-20210920
Behavioral task
behavioral11
Sample
scan.exe
Resource
win7-en-20211014
Behavioral task
behavioral12
Sample
scan.exe
Resource
win10-en-20210920
General
-
Target
rbs.exe
-
Size
53KB
-
MD5
c6edb2242607a0e09ac7cddc4d65443f
-
SHA1
8a09c4f1b8c930b6f3fff304e4fc6dc12639820d
-
SHA256
4ef4c2b02aeef11ca823584186903598cdf844eb1d089ca94c2aedd776e901cd
-
SHA512
4a79134da78fdf5e11323ad234764c48adc6c7269d7814b8e17373971d3de101e048a7975fb47bf946b6df71f94885ef80ded8903bf31fae49a8e5d21433d692
Malware Config
Extracted
C:\how_to_back_files.html
href="help_24_decr1@outlook.com
">help_24_decr1@outlook.com
href="help_24_decr2@outlook.com">help_24_decr2@outlook.com</a>
Signatures
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rbs.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\PushSend.tiff rbs.exe File renamed C:\Users\Admin\Pictures\PushSend.tiff => C:\Users\Admin\Pictures\PushSend.tiff.reads rbs.exe File renamed C:\Users\Admin\Pictures\SuspendProtect.tif => C:\Users\Admin\Pictures\SuspendProtect.tif.reads rbs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 25 IoCs
Processes:
rbs.exedescription ioc process File opened for modification C:\Users\Public\desktop.ini rbs.exe File opened for modification C:\Users\Public\Music\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Videos\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Music\desktop.ini rbs.exe File opened for modification C:\Users\Public\Documents\desktop.ini rbs.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini rbs.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini rbs.exe File opened for modification C:\Users\Public\Videos\desktop.ini rbs.exe File opened for modification C:\Users\Public\Pictures\desktop.ini rbs.exe File opened for modification C:\Users\Public\Downloads\desktop.ini rbs.exe File opened for modification C:\Users\Public\Desktop\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini rbs.exe File opened for modification C:\Program Files (x86)\desktop.ini rbs.exe File opened for modification C:\Users\Public\Libraries\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Searches\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Links\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Documents\desktop.ini rbs.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini rbs.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rbs.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\ui-strings.js rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\et_get.svg rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_nb_135x40.svg rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons2x.png rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\how_to_back_files.html rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\ui-strings.js rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\how_to_back_files.html rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\check-mark-1x.png rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot.cur rbs.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_es-419.dll rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main-selector.css rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sk_get.svg rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview2x.png rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_listview_18.svg rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\ui-strings.js rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_sk.dll rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif rbs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\how_to_back_files.html rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fil_get.svg rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-tool-view.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\ui-strings.js rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_zh_cn_135x40.svg rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\es-419_get.svg rbs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_pattern_RHP.png rbs.exe