Overview
overview
10Static
static
100c6f444c69...79.exe
windows7-x64
100c6f444c69...79.exe
windows10-2004-x64
1013828b390d...31.exe
windows7-x64
113828b390d...31.exe
windows10-2004-x64
115b57c1b68...ed.exe
windows7-x64
115b57c1b68...ed.exe
windows10-2004-x64
11af1ca666e...8e.exe
windows7-x64
11af1ca666e...8e.exe
windows10-2004-x64
128d7e6fe31...69.exe
windows7-x64
128d7e6fe31...69.exe
windows10-2004-x64
12cf54942e8...fc.exe
windows7-x64
102cf54942e8...fc.exe
windows10-2004-x64
1038834b796e...d1.exe
windows7-x64
138834b796e...d1.exe
windows10-2004-x64
13d7cf20ca6...83.exe
windows7-x64
13d7cf20ca6...83.exe
windows10-2004-x64
14e18f9293a...bf.exe
windows7-x64
14e18f9293a...bf.exe
windows10-2004-x64
159868f4b34...3f.exe
windows7-x64
159868f4b34...3f.exe
windows10-2004-x64
1731adcf2d7...61.exe
windows7-x64
1731adcf2d7...61.exe
windows10-2004-x64
17b2449bb8b...87.exe
windows7-x64
17b2449bb8b...87.exe
windows10-2004-x64
17e363b5f1b...8e.exe
windows7-x64
17e363b5f1b...8e.exe
windows10-2004-x64
1Analysis
-
max time kernel
390s -
max time network
517s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 04:25
Behavioral task
behavioral1
Sample
0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
1af1ca666e48afc933e2eda0ae1d6e88ebd23d27c54fd1d882161fd8c70b678e.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
1af1ca666e48afc933e2eda0ae1d6e88ebd23d27c54fd1d882161fd8c70b678e.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
28d7e6fe31dc00f82cb032ba29aad6429837ba5efb83c2ce4d31d565896e1169.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
28d7e6fe31dc00f82cb032ba29aad6429837ba5efb83c2ce4d31d565896e1169.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
2cf54942e8cf0ef6296deaa7975618dadff0c32535295d3f0d5f577552229ffc.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
2cf54942e8cf0ef6296deaa7975618dadff0c32535295d3f0d5f577552229ffc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
38834b796ed025563774167716a477e9217d45e47def20facb027325f2a790d1.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
38834b796ed025563774167716a477e9217d45e47def20facb027325f2a790d1.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
4e18f9293a6a72d5d42dad179b532407f45663098f959ea552ae43dbb9725cbf.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
4e18f9293a6a72d5d42dad179b532407f45663098f959ea552ae43dbb9725cbf.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f.exe
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
7b2449bb8be1b37a9d580c2592a67a759a3116fe640041d0f36dc93ca3db4487.exe
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
7b2449bb8be1b37a9d580c2592a67a759a3116fe640041d0f36dc93ca3db4487.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e.exe
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e.exe
Resource
win10v2004-20220812-en
General
-
Target
0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479.exe
-
Size
2.6MB
-
MD5
bb266486ee8ac70c0687989e02cefa14
-
SHA1
11203786b17bb3873d46acae32a898c8dac09850
-
SHA256
0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479
-
SHA512
a167779fc95a5cf0a3eff86211e9e08c282470e050b17ae62c7499a82ea59b3447446eafea9d7b5c5ba833b7a2d060f76530b00509dd5ff7904a0735d83e14c4
-
SSDEEP
49152:rEqvaaAjc2hdKjb8WXqE1PiEbE/TKMt3/RgaJ2wW4PRT8O1:rbyaALKjwWXV1P9oVvwwW4JT8
Malware Config
Extracted
blackcat
- Username:
KELLERSUPPLY\Administrator - Password:
d@gw00d
- Username:
KELLERSUPPLY\AdminRecovery - Password:
K3ller!$Supp1y
- Username:
.\Administrator - Password:
d@gw00d
- Username:
.\Administrator - Password:
K3ller!$Supp1y
-
enable_network_discovery
true
-
enable_self_propagation
false
-
enable_set_wallpaper
true
-
extension
sykffle
-
note_file_name
RECOVER-${EXTENSION}-FILES.txt
-
note_full_text
>> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21 >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=${ACCESS_KEY}
Signatures
-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.