djvu | dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa

General

Target

dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
Size

840KB
MD5

13680cf3b522a1544e0e1cb3bc5f730c
SHA1

deb8f8a5b5d6896e11ce277b9f1921e07a636e05
SHA256

dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa
SHA512

0f4ff57cef7d9637cea2d120c2d0b6f82b9f9775fd816df5e1d9f2dec91cc855fbd1ef9466e68d77df286a8fe5889f78d9f004f4bbdb3dde96fedaeaa40d9d44

Score

10^/10

djvu vidar 517 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

C2

http://tzgl.org/fhsgtsspen6/get.php

Attributes

extension
.wnlu
offline_id
gYuqQ5GsAaJom08TivUVhlPzZDKd916x4NcXrWt1
payload_url
http://kotob.top/dl/build2.exe
http://tzgl.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-m8LBBi8x8F Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0357Sigrj

rsa_pubkey.plain

Extracted

Family

vidar

Version

49

Botnet

517

C2

https://mstdn.social/@sergeev43

https://koyu.space/@sergeev45

Attributes

profile_id
517

Signatures

Detected Djvu ransomware 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2648-116-0x00000000008C0000-0x00000000009DB000-memory.dmp	family_djvu
behavioral1/memory/3364-117-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3364-118-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/3364-119-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/376-125-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/376-126-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/672-135-0x0000000000400000-0x00000000004DC000-memory.dmp	family_vidar
behavioral1/memory/672-136-0x00000000004A539D-mapping.dmp	family_vidar
behavioral1/memory/972-138-0x0000000000660000-0x00000000007AA000-memory.dmp	family_vidar
behavioral1/memory/672-139-0x0000000000400000-0x00000000004DC000-memory.dmp	family_vidar

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

build2.exebuild2.exe

pid process

972 build2.exe
672 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

1116 icacls.exe

pid	process
972	build2.exe
672	build2.exe

pid	process
1116	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\844c9255-94f4-47b1-b6ea-552fb213c2ba\\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe\" --AutoStart"	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 api.2ip.ua
11 api.2ip.ua
16 api.2ip.ua

flow	ioc
10	api.2ip.ua
11	api.2ip.ua
16	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

Processes:

dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exedbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exebuild2.exe

description	pid	process	target process
PID 2648 set thread context of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 set thread context of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 972 set thread context of 672	972	build2.exe	build2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exedbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe

pid	process
3364	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
3364	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
376	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
376	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exedbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exedbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exedbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exebuild2.exe

C:\Users\Admin\AppData\Local\Temp\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
"C:\Users\Admin\AppData\Local\Temp\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2648

C:\Users\Admin\AppData\Local\Temp\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
"C:\Users\Admin\AppData\Local\Temp\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe"
2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\844c9255-94f4-47b1-b6ea-552fb213c2ba" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:1116

C:\Users\Admin\AppData\Local\Temp\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
"C:\Users\Admin\AppData\Local\Temp\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3936

C:\Users\Admin\AppData\Local\Temp\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
"C:\Users\Admin\AppData\Local\Temp\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:376

C:\Users\Admin\AppData\Local\51d05e0f-f9a9-448f-b2cf-b3ad04ee441b\build2.exe
"C:\Users\Admin\AppData\Local\51d05e0f-f9a9-448f-b2cf-b3ad04ee441b\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\51d05e0f-f9a9-448f-b2cf-b3ad04ee441b\build2.exe
"C:\Users\Admin\AppData\Local\51d05e0f-f9a9-448f-b2cf-b3ad04ee441b\build2.exe"
6⤵
- Executes dropped EXE
PID:672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
dfd1d8c11c8e104d9ca31b6b589fb717

SHA1
50e4a082219aa5c4e2376f1e9910a748287bef36

SHA256
7e5518f47ccc38390147991b40a3addde74cb52264f8808cf1088f5f711e2345

SHA512
31fea2c3cd0ad810a7a298251571ef14ac2445f8fe1fc5e806f26378a9397c47a04790b9a3c5a02af83c0e572878e7d6c59c7751a8be012902c1c86b699dd216

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
0ffb91dc0ac91e9630245216a5677aff

SHA1
d861ae5652a25d5f0396178818058150adf00273

SHA256
b88d9ca03ea0f1c5900d203f3e416f0fa159823801358261823b5898cd97fe6b

SHA512
063f2bce3ead49f7bd9a7c8aa21161f78a25362034c2973f4d4721001f475296b7aee221801b7dc28a342bb5f4688be58c999ff13e777a19d8eb8147a75bcbc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
f5bef48123094d23dc3e389493494aa8

SHA1
3728661373ca6a41ebb62acd156740d88e39d5f1

SHA256
8a9775c338a8d0b29a5708e6e0dcc5764d2026546686f0e7d5e6a30231f23b3f

SHA512
8045a4d6c18eea6637f22359ab85a3690ec52c319b39b55a52eeb53f0f74e8dcc1722864e20ef26a5b9bc9e015507e536ae6a80ac93e80fc8e4c62fec2c432d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
4816855f268ec7021b669d2d8de595e2

SHA1
6eb7f0f4a8325620eae81e7984f6fdcb5d9f581a

SHA256
5239f5fbe56d32ca789d98c72eec1c01e79d8ce59de5b2fd3631ee31b6361872

SHA512
f5a23d684b451974b11a6b061d83b9613f2c23d25ad5a2b2e1933b745a51def555298f104f43694204d391214d3ec7644cf8ee7b846c4dba622791335d154562

Download Submit
C:\Users\Admin\AppData\Local\51d05e0f-f9a9-448f-b2cf-b3ad04ee441b\build2.exe
MD5
9d0d5618a8d30f60180bfd2e061f78de

SHA1
b6d80a023d6b68901e48c4e194dd07ec08704743

SHA256
0241e8302dd7f1dbb90ad8f26e6d852b665c4068dcd02903f0eac1b7208cf9c3

SHA512
aa45527eac08af781a30f236d24ff68375aaef752f8da893f9c31bbfb2ec302b8a18228f0d58fd71cbb2c5b60d857c240c1cc5aff6c60a78689e099158befece

Download Submit
C:\Users\Admin\AppData\Local\51d05e0f-f9a9-448f-b2cf-b3ad04ee441b\build2.exe
MD5
9d0d5618a8d30f60180bfd2e061f78de

SHA1
b6d80a023d6b68901e48c4e194dd07ec08704743

SHA256
0241e8302dd7f1dbb90ad8f26e6d852b665c4068dcd02903f0eac1b7208cf9c3

SHA512
aa45527eac08af781a30f236d24ff68375aaef752f8da893f9c31bbfb2ec302b8a18228f0d58fd71cbb2c5b60d857c240c1cc5aff6c60a78689e099158befece

Download Submit
C:\Users\Admin\AppData\Local\51d05e0f-f9a9-448f-b2cf-b3ad04ee441b\build2.exe
MD5
9d0d5618a8d30f60180bfd2e061f78de

SHA1
b6d80a023d6b68901e48c4e194dd07ec08704743

SHA256
0241e8302dd7f1dbb90ad8f26e6d852b665c4068dcd02903f0eac1b7208cf9c3

SHA512
aa45527eac08af781a30f236d24ff68375aaef752f8da893f9c31bbfb2ec302b8a18228f0d58fd71cbb2c5b60d857c240c1cc5aff6c60a78689e099158befece

Download Submit
C:\Users\Admin\AppData\Local\844c9255-94f4-47b1-b6ea-552fb213c2ba\dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
MD5
13680cf3b522a1544e0e1cb3bc5f730c

SHA1
deb8f8a5b5d6896e11ce277b9f1921e07a636e05

SHA256
dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa

SHA512
0f4ff57cef7d9637cea2d120c2d0b6f82b9f9775fd816df5e1d9f2dec91cc855fbd1ef9466e68d77df286a8fe5889f78d9f004f4bbdb3dde96fedaeaa40d9d44

Download Submit
memory/376-125-0x0000000000424141-mapping.dmp

Download
memory/376-126-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/672-139-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/672-136-0x00000000004A539D-mapping.dmp

Download
memory/672-135-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/972-134-0x0000000000861000-0x00000000008DE000-memory.dmp

Filesize
500KB

Download
memory/972-138-0x0000000000660000-0x00000000007AA000-memory.dmp

Filesize
1.3MB

Download
memory/972-131-0x0000000000000000-mapping.dmp

Download
memory/1116-120-0x0000000000000000-mapping.dmp

Download
memory/2648-115-0x0000000000828000-0x00000000008B9000-memory.dmp

Filesize
580KB

Download
memory/2648-116-0x00000000008C0000-0x00000000009DB000-memory.dmp

Filesize
1.1MB

Download
memory/3364-117-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3364-118-0x0000000000424141-mapping.dmp

Download
memory/3364-119-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3936-123-0x00000000007D7000-0x0000000000868000-memory.dmp

Filesize
580KB

Download
memory/3936-122-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 2648 wrote to memory of 3364	2648	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3364 wrote to memory of 1116	3364	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	icacls.exe
PID 3364 wrote to memory of 1116	3364	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	icacls.exe
PID 3364 wrote to memory of 1116	3364	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	icacls.exe
PID 3364 wrote to memory of 3936	3364	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3364 wrote to memory of 3936	3364	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3364 wrote to memory of 3936	3364	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 3936 wrote to memory of 376	3936	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe
PID 376 wrote to memory of 972	376	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	build2.exe
PID 376 wrote to memory of 972	376	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	build2.exe
PID 376 wrote to memory of 972	376	dbf25284a5e55f027512fb680216f7c63e12898b49f69c4ccae60172089500fa.exe	build2.exe
PID 972 wrote to memory of 672	972	build2.exe	build2.exe
PID 972 wrote to memory of 672	972	build2.exe	build2.exe
PID 972 wrote to memory of 672	972	build2.exe	build2.exe
PID 972 wrote to memory of 672	972	build2.exe	build2.exe
PID 972 wrote to memory of 672	972	build2.exe	build2.exe
PID 972 wrote to memory of 672	972	build2.exe	build2.exe
PID 972 wrote to memory of 672	972	build2.exe	build2.exe
PID 972 wrote to memory of 672	972	build2.exe	build2.exe

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads