Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-03-2023 12:41

General

  • Target

    3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe

  • Size

    744KB

  • MD5

    65fd3040962b0f6e817e413048cf0820

  • SHA1

    59a44208db726f0e32d065d2492320c07cc079f8

  • SHA256

    3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046

  • SHA512

    450ddf8530d7598776e03e1d502b516321f4e4f0612f1726fc3c9e9ab618762b2dfd83c175aa1c9ebff14ca0bd6b5654fb1eb0e8e015d421f8bef958848d068a

  • SSDEEP

    12288:9KqQPLGsiOUgbwxjATfI6iWckR8Sl1WnZd4CGsKxinycNWGK9P2BG7My:9dK0xjWIh8inZOseEyGCYGw

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/test2/get.php

Attributes
  • extension

    .jywd

  • offline_id

    MEMHlobHgXqvmTWaMsLcwGZhDOd00bblO1yevst1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://zexeq.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-fkW8qLaCVQ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0675JOsie

rsa_pubkey.plain

Extracted

Family

vidar

Version

3.2

Botnet

5df88deb5dde677ba658b77ad5f60248

C2

https://steamcommunity.com/profiles/76561199489580435

https://t.me/tabootalks

Attributes
  • profile_id_v2

    5df88deb5dde677ba658b77ad5f60248

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 OPR/91.0.4516.79

Signatures

  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe
    "C:\Users\Admin\AppData\Local\Temp\3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe
      "C:\Users\Admin\AppData\Local\Temp\3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\5e2c8c62-6f42-460f-82f0-bdb70429145b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:868
      • C:\Users\Admin\AppData\Local\Temp\3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe
        "C:\Users\Admin\AppData\Local\Temp\3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:560
        • C:\Users\Admin\AppData\Local\Temp\3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe
          "C:\Users\Admin\AppData\Local\Temp\3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1240
          • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build2.exe
            "C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2944
            • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build2.exe
              "C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build2.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1912
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build2.exe" & exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2160
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 6
                  8⤵
                  • Delays execution with timeout.exe
                  PID:2344
          • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build3.exe
            "C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3540
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              6⤵
              • Creates scheduled task(s)
              PID:3836
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4704

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\mozglue.dll

    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • C:\ProgramData\nss3.dll

    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    2KB

    MD5

    e5b1cc0ae5af6a8277d75cff4af2c5e8

    SHA1

    4768fff3d4bbe02f89683b4a0e7b15b24b54eb9f

    SHA256

    d950c0d748aae641d71b11cd1c519b289917c23bee1a2b6bc5c496fd8e5d4655

    SHA512

    57a4737deeefac0124d73b52525993fecbbebd21a556ece87f8e79e845e07f037abb5e49f7458e8a010935c6691f18fbb913d77ecfb2ba902067788c483ec3d7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9

    Filesize

    506B

    MD5

    093e3881083ac3d034690d7fd458bfcc

    SHA1

    55c88e1bb22c1e64e3050e94d5473230472784df

    SHA256

    5af630de99848a3e99f525b0ac5173c51ff69b0f19117d66b2d5c0ef98187fe0

    SHA512

    1d2ea2b6d2d46db4219140d122559c8276a68c419ca2ed63ef9f6d74f0aa747afe2a27cce7ddaff899c9d99377747a86f27381d3af9dd6cfa99864fba4b98524

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    488B

    MD5

    b64e6ab41f238360b599773ef84dc323

    SHA1

    3593a29dfa0e44597a85e45da907de9ff7adc26a

    SHA256

    2a198026301f118a8a7d262c5761d3d8720197d0176706b8c4196f9e0d95164d

    SHA512

    7daf7448767b0266d6c4e413739298878dbe9133adeb2f97e9a41a4fae199660b48b73d230a6d35f07b2a736b2d308ee77a3a3c369fdae6d827c609db7295151

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9

    Filesize

    248B

    MD5

    4ad930c1a1b5cf2220463d2065aacaa6

    SHA1

    ce328f64ad8cab6f565ead0e0bf809d5645d42b5

    SHA256

    b944ccf7b8c15658566b2f679c8a113d16fa347d1c247d6d35d74c8ac2d1cc6f

    SHA512

    c7ccddde0ada6bb0a0919dbd39ff3349bedc40ce44c927467ddfb83a3e569d0f5e7d64f5eec44db8f2dd65808b0d8175f1a69368b561b3b813c208320d244394

  • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build2.exe

    Filesize

    416KB

    MD5

    aa18968e6cfbdc382ada6a3ed2852085

    SHA1

    4a41fa1a182916d5790aa2071106b3441d64468d

    SHA256

    c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

    SHA512

    8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

  • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build2.exe

    Filesize

    416KB

    MD5

    aa18968e6cfbdc382ada6a3ed2852085

    SHA1

    4a41fa1a182916d5790aa2071106b3441d64468d

    SHA256

    c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

    SHA512

    8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

  • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build2.exe

    Filesize

    416KB

    MD5

    aa18968e6cfbdc382ada6a3ed2852085

    SHA1

    4a41fa1a182916d5790aa2071106b3441d64468d

    SHA256

    c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

    SHA512

    8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

  • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build2.exe

    Filesize

    416KB

    MD5

    aa18968e6cfbdc382ada6a3ed2852085

    SHA1

    4a41fa1a182916d5790aa2071106b3441d64468d

    SHA256

    c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

    SHA512

    8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

  • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build3.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build3.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Local\563174b8-9f79-4bfa-941e-1ba0536fb831\build3.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Local\5e2c8c62-6f42-460f-82f0-bdb70429145b\3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046.exe

    Filesize

    744KB

    MD5

    65fd3040962b0f6e817e413048cf0820

    SHA1

    59a44208db726f0e32d065d2492320c07cc079f8

    SHA256

    3446aa1bc64bc02d5d0759cfe030fe20b97dee8b3fb41a210b12f3da94100046

    SHA512

    450ddf8530d7598776e03e1d502b516321f4e4f0612f1726fc3c9e9ab618762b2dfd83c175aa1c9ebff14ca0bd6b5654fb1eb0e8e015d421f8bef958848d068a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • memory/1240-167-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1240-164-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1240-166-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1240-160-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1240-276-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1240-153-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1240-159-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1240-158-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1240-192-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1240-152-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1520-135-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1520-134-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1520-148-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1520-138-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1520-137-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1912-196-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/1912-207-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

  • memory/1912-179-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/1912-275-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/1912-183-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/1912-277-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/1912-278-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/1912-181-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/2672-136-0x0000000002300000-0x000000000241B000-memory.dmp

    Filesize

    1.1MB

  • memory/2944-182-0x0000000002DF0000-0x0000000002E47000-memory.dmp

    Filesize

    348KB