Overview

overview

10

Static

static

1

filecoder.dmg

macos_amd64

1

flawedammyy.exe

windows7_x64

10

flawedammyy.exe

windows10-2004_x64

10

qakbot.dll

windows7_x64

10

qakbot.dll

windows10-2004_x64

10

redline.exe

windows7_x64

10

redline.exe

windows10-2004_x64

10

seon.exe

windows7_x64

10

seon.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    39s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    24-06-2022 13:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    seon.exe

  • Size

    62KB

  • MD5

    7d3573bee1a9acd192c50bc72a65ef7a

  • SHA1

    8ff77e69046c8cecd4407c536219e6fc1a747af7

  • SHA256

    221ab2fabe92b623834e7214d05dbef0cdc2b4399d34721de63e7c32ab5820ea

  • SHA512

    dcf3998861c2c1818d05ba526134edddee58bea51d4065ec5d156dfac2d24a63d65df057a1319e0886bdf37a394f82fb4435c0292c3e1f135646623ad3aaf347

Score
10/10
seonransomwaretrojan

Malware Config

Extracted

Path

C:\MSOCache\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
SEON RANSOMWARE ver 0.2 all your files has been encrypted There is only way to get your files back: contact with us and pay $1500 We accept Bitcoin and other cryptocurrencies Do not try to reinstall operation system on your computer Do not try to decrypt files with third party tools, this can lead to data loss You can decrypt 1 file for free Our contact emails: [email protected] [email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme.hta

Ransom Note
All your documents, photos, databases and other important files have been encrypted and you can't decrypt it yourself. No one but us can return your files. Free decryption utility does not exist. Each file is encrypted with its unique key, cryptography based on elliptic curves, key recovery is impossible. Focus on the problem, follow your instructions and everything will be fine. DON'T PANIC! YOU CAN RETURN ALL YOUR FILES! FREE decrypting as guarantee You can test decryption 1 any file for free (with help our special software " SEON Decryptor "). What to do? First you should write me and i'll send you a special software " SEON Decryptor " (this software needed to decrypt encrypted files). To start the process of decrypting ALL files, you need buy key to the " SEON Decryptor ". The price is $1500 in any cryptocurrency . Contacts E-Mail: [email protected] E-Mail: [email protected] Attention! Decryption keys are individual, the keys of other users will not work for you Do not try to decrypt files with third party tools, this can lead to data loss Do not try to reinstall operation system on your computer

Signatures

  • Seon

    The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.

    trojanransomwareseon
  • Modifies extensions of user files 14 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\seon.exe
    "C:\Users\Admin\AppData\Local\Temp\seon.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Windows\SysWOW64\mshta.exe
      mshta.exe C:\Users\Admin\AppData\Local\Temp\readme.hta
      2⤵
      • Modifies Internet Explorer settings
      PID:2028

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\readme.hta
    Filesize

    16KB

    MD5

    867e488f26e23d94a78cd020a852cf30

    SHA1

    29a4b0dc6edae5fbdf6bb13f60029ef4a48c8d29

    SHA256

    da37639b77c11ccfe848ae6457e08eb98521ee01d481a8c7ce5d410576c2e606

    SHA512

    3a30ef7d5adabae108b50060cad992383a8b8d951cbd32c99379a7e7b0a1276fd2a912b0f2f0d4f16e777ef045ba9c5e81f2dfe67bc3e7b04bbe0d69881ac659

    Download Submit

  • memory/376-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

    Filesize

    8KB

    Download