Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 05:10
Static task
static1
Behavioral task
behavioral1
Sample
db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe
Resource
win10-en-20211104
General
-
Target
db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe
-
Size
781KB
-
MD5
39f7cad3ef720ddde86eabf1cf9b74ba
-
SHA1
9876160be48b9575e892e59debab6e0eefa04101
-
SHA256
db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731
-
SHA512
0a2b233a8984fc1fc1eb7601c08a36d1e0f0245c6279ee3ccdf703d2c9759f2e4a9134838b1d171eec491251304d8d83db6d7dc91ecdf28192367693a5578ad0
Malware Config
Extracted
djvu
http://tzgl.org/lancer/get.php
-
extension
.yqal
-
offline_id
K3PMMX2aWwpnYby88Dzg7tmaIW7Tv0HMWvSyr7t1
-
payload_url
http://kotob.top/dl/build2.exe
http://tzgl.org/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-rIyEiK9ekc Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: helprestoremanager@airmail.cc Your personal ID: 0356gSd743d
Signatures
-
Detected Djvu ransomware 6 IoCs
Processes:
resource yara_rule behavioral1/memory/3508-119-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/3508-118-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2612-121-0x0000000004B40000-0x0000000004C5B000-memory.dmp family_djvu behavioral1/memory/3508-122-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1044-127-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/1044-132-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\09f80755-ea75-4a24-a798-9b6e4ba36fec\\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe\" --AutoStart" db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.2ip.ua 11 api.2ip.ua 16 api.2ip.ua -
Suspicious use of SetThreadContext 2 IoCs
Processes:
db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exedb6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exedescription pid process target process PID 2612 set thread context of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 set thread context of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exedb6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exepid process 3508 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe 3508 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe 1044 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe 1044 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exedb6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exedb6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exedescription pid process target process PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 2612 wrote to memory of 3508 2612 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3508 wrote to memory of 3320 3508 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe icacls.exe PID 3508 wrote to memory of 3320 3508 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe icacls.exe PID 3508 wrote to memory of 3320 3508 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe icacls.exe PID 3508 wrote to memory of 3720 3508 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3508 wrote to memory of 3720 3508 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3508 wrote to memory of 3720 3508 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe PID 3720 wrote to memory of 1044 3720 db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe"C:\Users\Admin\AppData\Local\Temp\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe"C:\Users\Admin\AppData\Local\Temp\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\09f80755-ea75-4a24-a798-9b6e4ba36fec" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe"C:\Users\Admin\AppData\Local\Temp\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe"C:\Users\Admin\AppData\Local\Temp\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
237cc7db072d97a949e15c2d8dbea891
SHA143ef7b53667e94ae04496fa6cf6efc7f9a8ba83f
SHA2567f9669eedb0bdb3b6647128101ec024ac5fc2447bd4372fbc8b4389f5d255acb
SHA51207c69dbcb95369ffcfdcbe402d582e7dcad1b5f2976f9156460197c891eefae41b43d2640df96d08c4ae2338a5c8d03aeaa662487d0635678d34622aede96b2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
5db4d4fdb4428e5d3c794ed0a7c25958
SHA1374866bf683c5c6a3620d7dcfe29ef04221c4723
SHA25619ee4604acc3747d7a43fe1703dcacf39ca80e58a5f20e8607172b8f7037e45e
SHA5128ad3ce80577dfc0e4edfb40c548d6b5ba88ca22bca51d0c9fe757d9e155372fe4c212ae12e8f7ed13fd40369a0722399b41c5f0edf9eb03de57fbd9890b2989d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
82837ae52aee4aca47a2d0e910671760
SHA13e6a56a93c7bcf5515693903d1503810de851679
SHA256a34299c64d09b2026d151122c126fed83255868164573d30b2f9d4e62c682e2e
SHA512f83d51c4528895d7f8f9c38ef80a73a4f77384db1eeaf925860e1908c63e4dbd078b25df1c7c1ee56eef549207e3622c46c35fff86533ceee564e6a5de2409f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
13f775780ba9fc0af8ecd0bca499fb8d
SHA1b03eaaa161e685388e33299f20f9a762a9cb3344
SHA25613f92f09eb74ede15a0a25b3d705ee37d98dd66074c04358aeaaf12b53655c0a
SHA51210fabff990baaab82ccd1884675c58c513e75d969a90647da6bb9fe2acaea260c89ea593052d8487833b206abb562550caa0429cba33916068a921a4427753ce
-
C:\Users\Admin\AppData\Local\09f80755-ea75-4a24-a798-9b6e4ba36fec\db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731.exeMD5
39f7cad3ef720ddde86eabf1cf9b74ba
SHA19876160be48b9575e892e59debab6e0eefa04101
SHA256db6bc6d44f7c1438207ca60c6397ce38515fd3f7ca227a6d959dd19a341f0731
SHA5120a2b233a8984fc1fc1eb7601c08a36d1e0f0245c6279ee3ccdf703d2c9759f2e4a9134838b1d171eec491251304d8d83db6d7dc91ecdf28192367693a5578ad0
-
memory/1044-127-0x0000000000424141-mapping.dmp
-
memory/1044-132-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2612-120-0x0000000004AA0000-0x0000000004B32000-memory.dmpFilesize
584KB
-
memory/2612-121-0x0000000004B40000-0x0000000004C5B000-memory.dmpFilesize
1.1MB
-
memory/3320-123-0x0000000000000000-mapping.dmp
-
memory/3508-119-0x0000000000424141-mapping.dmp
-
memory/3508-122-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3508-118-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3720-125-0x0000000000000000-mapping.dmp