snatch | e5eb247b9775f54746c5442d05a5befd0fb7be2a3847ed60541ccd8aad3d32ce

Analysis

max time kernel
164s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1FEC17F108AF2F1BEEF1E986B0A1C621.exe
Size

2.3MB
MD5

1fec17f108af2f1beef1e986b0a1c621
SHA1

200d8fbef238346508feebd95c4112c23be1c240
SHA256

e5eb247b9775f54746c5442d05a5befd0fb7be2a3847ed60541ccd8aad3d32ce
SHA512

1e4b3354c7491b3ca718725baacb9ee18324994b15672ca7df05cb89a54f9cf9cce06c8583fae69227c4ab41a6898c77edbc240d7b22d3a991daa425974a2880
SSDEEP

49152:sU0PZgvJ6yzfUeac3DVqi3FmTJYRXCbxM8MGwZO2hnZXDaYKbCre4AWz5E:sU02vo4MNSFmTJSXqMRGj29ZXDaYgCSE

Score

10^/10

snatch ransomware upx

Malware Config

Signatures

Detecting the common Go functions and variables names used by Snatch ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/1968-132-0x0000000000400000-0x0000000000814000-memory.dmp	family_snatch
behavioral2/memory/1968-138-0x0000000000400000-0x0000000000814000-memory.dmp	family_snatch

Snatch Ransomware
Ransomware family generally distributed through RDP bruteforce attacks.
ransomware snatch

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1968-132-0x0000000000400000-0x0000000000814000-memory.dmp	upx
behavioral2/memory/1968-138-0x0000000000400000-0x0000000000814000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\cmm\sRGB.pf	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\HOW TO RESTORE YOUR FILES.TXT	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_hu.jar	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\splash.gif.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\nacl_irt_x86_64.nexe.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunec.jar.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_ja.properties	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\management\snmp.acl.template.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\HOW TO RESTORE YOUR FILES.TXT	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ko_KR.jar.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\ext\jaccess.jar.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\HOW TO RESTORE YOUR FILES.TXT	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\HOW TO RESTORE YOUR FILES.TXT	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\HOW TO RESTORE YOUR FILES.TXT	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\HOW TO RESTORE YOUR FILES.TXT	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.gqlmcwnhh	1FEC17F108AF2F1BEEF1E986B0A1C621.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms	1FEC17F108AF2F1BEEF1E986B0A1C621.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3012	sc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1700	1968	1FEC17F108AF2F1BEEF1E986B0A1C621.exe	85
PID 1968 wrote to memory of 1700	1968	1FEC17F108AF2F1BEEF1E986B0A1C621.exe	85
PID 1968 wrote to memory of 1700	1968	1FEC17F108AF2F1BEEF1E986B0A1C621.exe	85
PID 1700 wrote to memory of 3012	1700	cmd.exe	87
PID 1700 wrote to memory of 3012	1700	cmd.exe	87
PID 1700 wrote to memory of 3012	1700	cmd.exe	87
PID 1700 wrote to memory of 2156	1700	cmd.exe	88
PID 1700 wrote to memory of 2156	1700	cmd.exe	88
PID 1700 wrote to memory of 2156	1700	cmd.exe	88
PID 1968 wrote to memory of 4752	1968	1FEC17F108AF2F1BEEF1E986B0A1C621.exe	89
PID 1968 wrote to memory of 4752	1968	1FEC17F108AF2F1BEEF1E986B0A1C621.exe	89
PID 1968 wrote to memory of 4752	1968	1FEC17F108AF2F1BEEF1E986B0A1C621.exe	89

C:\Users\Admin\AppData\Local\Temp\1FEC17F108AF2F1BEEF1E986B0A1C621.exe
"C:\Users\Admin\AppData\Local\Temp\1FEC17F108AF2F1BEEF1E986B0A1C621.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\qbuaslhhgmjmrk.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\sc.exe
    SC QUERY
    3⤵
    - Launches sc.exe
    PID:3012
- - C:\Windows\SysWOW64\findstr.exe
    FINDSTR SERVICE_NAME
    3⤵
    PID:2156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gybvlcretswvckttx.bat
  2⤵
  PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qbuaslhhgmjmrk.bat

Filesize
43B

MD5
55310bb774fff38cca265dbc70ad6705

SHA1
cb8d76e9fd38a0b253056e5f204dab5441fe932b

SHA256
1fbdb97893d09d59575c3ef95df3c929fe6b6ddf1b273283e4efadf94cdc802d

SHA512
40e5a5e8454ca3eaac36d732550e2c5d869a235e3bbc4d31c4afa038fe4e06f782fa0885e876ad8119be766477fdcc12c1d5d04d53cf6b324e366b5351fc7cd4

Download Submit
memory/1968-132-0x0000000000400000-0x0000000000814000-memory.dmp

Filesize
4.1MB

Download
memory/1968-138-0x0000000000400000-0x0000000000814000-memory.dmp

Filesize
4.1MB

Download