Overview

overview

10

Static

static

10

307a61c288...in.exe

windows7-x64

10

307a61c288...in.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2023 21:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.bin.exe

  • Size

    14KB

  • MD5

    4a42f739ce694db7b3cdd3c233ce7fb1

  • SHA1

    68fcc99e719b57308c9b1b3d4eef91dec62d02e5

  • SHA256

    307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b

  • SHA512

    15137fdc43519be2e83346d7a07c84d439e4da22e328722cb3da6bf1bcfbf584b2594901582ddf6ea363ae515e37cb1f32c407a8ebfe747a13562de927f92f54

  • SSDEEP

    384:0prr1gkDCgSZ75pbB7E68AvXIHqe939g83FMENKsB:arVDCp/h8QIOwiO

Score
10/10
xoristpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\HOW TO DECRYPT FILES.txt

Ransom Note
All your important files were encrypted on this computer. You can verify this by click on see files an try open them. Encrtyption was produced using unique KEY generated for this computer. To decrypted files, you need to otbtain private key. The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet; The server will destroy the key within 24 hours after encryption completed. Payment have to be made in maxim 24 hours To retrieve the private key, you need to pay 3 BITCOINS Bitcoins have to be sent to this address: 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK After you've sent the payment send us an email to : [email protected] with subject : ERROR-ID-63100778(3BITCOINS) If you are not familiar with bitcoin you can buy it from here : SITE : www.localbitcoin.com After we confirm the payment , we send the private key so you can decrypt your system.
Wallets

1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK

Signatures

  • Detected Xorist Ransomware 2 IoCs
  • Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist
  • Drops file in Drivers directory 46 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.bin.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    PID:2020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\desktop.ini
    Filesize

    129B

    MD5

    183a3c38b0cecfec6e071e5e0230c9d5

    SHA1

    512f4f9f160af1a4097d087a8537c286dd19783e

    SHA256

    dbcb7097128d51acaf60685dc7bb849d57499d4ce521e584166421f6d17a3cc1

    SHA512

    41f4510596979981d2fd13c20974af7a1a6a3f9ab205c54753f92bee3b75b7c2e65d5292db0b9ee932dede48c1b3e10074c2a7a6509cd00dabc2e169467e36c4

    Download Submit

  • memory/2020-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2020-56-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/2020-57-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download