Overview
overview
10Static
static
3cerber.exe
windows7-x64
10cerber.exe
windows10-2004-x64
10Locky.exe
windows7-x64
10Locky.exe
windows10-2004-x64
1026b4699a7b...39.exe
windows7-x64
626b4699a7b...39.exe
windows10-2004-x64
64c1dc73791...5c.exe
windows7-x64
64c1dc73791...5c.exe
windows10-2004-x64
6683a09da21...96.exe
windows7-x64
10683a09da21...96.exe
windows10-2004-x64
5unpacked.exe
windows7-x64
10unpacked.exe
windows10-2004-x64
10Resubmissions
14-05-2023 19:15
230514-xydc6sdc98 10General
-
Target
Ransomware.Cerber (2).zip
-
Size
1.6MB
-
Sample
230514-xydc6sdc98
-
MD5
5e321d806b5c4e59ca70d27a29048014
-
SHA1
552fa6fbfdd55c11a18ea6a81fb92169e859a49c
-
SHA256
ea46a1fb5b5896dfe1f49d26ca9946d7fd76d525da791dee481694912f02d257
-
SHA512
1b05f4e8da82ee834f9c8982dc989d6c861622253e1894d0dc57c7dfae4c120d7a70ac581bc4af4aec36b2a7b0492b4805144bed023036f4818a2225c110c04e
-
SSDEEP
49152:Zm0woyiNyrSV0Bw7eQxwkbD08b2RVYT2lO:Z5wotNkSV0fQFZ2RVYP
Static task
static1
Behavioral task
behavioral1
Sample
cerber.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cerber.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Locky.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Locky.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
unpacked.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
unpacked.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___CH3Y5_.txt
cerber
http://p27dokhpz2n7nvgr.onion/00FB-3C52-0C83-0446-98BF
http://p27dokhpz2n7nvgr.12hygy.top/00FB-3C52-0C83-0446-98BF
http://p27dokhpz2n7nvgr.14ewqv.top/00FB-3C52-0C83-0446-98BF
http://p27dokhpz2n7nvgr.14vvrc.top/00FB-3C52-0C83-0446-98BF
http://p27dokhpz2n7nvgr.129p1t.top/00FB-3C52-0C83-0446-98BF
http://p27dokhpz2n7nvgr.1apgrn.top/00FB-3C52-0C83-0446-98BF
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___BVQ9B0_.txt
cerber
http://p27dokhpz2n7nvgr.onion/AA21-3C34-C823-0446-913E
http://p27dokhpz2n7nvgr.12hygy.top/AA21-3C34-C823-0446-913E
http://p27dokhpz2n7nvgr.14ewqv.top/AA21-3C34-C823-0446-913E
http://p27dokhpz2n7nvgr.14vvrc.top/AA21-3C34-C823-0446-913E
http://p27dokhpz2n7nvgr.129p1t.top/AA21-3C34-C823-0446-913E
http://p27dokhpz2n7nvgr.1apgrn.top/AA21-3C34-C823-0446-913E
Extracted
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___BN3UFSGI_.hta
cerber
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Targets
-
-
Target
cerber.exe
-
Size
604KB
-
MD5
8b6bc16fd137c09a08b02bbe1bb7d670
-
SHA1
c69a0f6c6f809c01db92ca658fcf1b643391a2b7
-
SHA256
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
-
SHA512
b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
-
SSDEEP
6144:yYghlI5/u8f1mr+4RJ99MpDa52RX5wRDhOOU0qsR:yYKlYmDXEpDHRXP01
Score10/10-
Blocklisted process makes network request
-
Contacts a large (1095) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Contacts a large (1106) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
-
-
Target
Locky
-
Size
180KB
-
MD5
b06d9dd17c69ed2ae75d9e40b2631b42
-
SHA1
b606aaa402bfe4a15ef80165e964d384f25564e4
-
SHA256
bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
-
SHA512
8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c
-
SSDEEP
3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6
Score10/10 -
-
-
Target
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin
-
Size
225KB
-
MD5
af2379cc4d607a45ac44d62135fb7015
-
SHA1
39b6d40906c7f7f080e6befa93324dddadcbd9fa
-
SHA256
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
-
SHA512
69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
-
SSDEEP
6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
-
-
Target
4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.bin
-
Size
788KB
-
MD5
a92f13f3a1b3b39833d3cc336301b713
-
SHA1
d1c62ac62e68875085b62fa651fb17d4d7313887
-
SHA256
4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c
-
SHA512
361a5199b5a6321d88f6e7b66eaad3756b4ea7a706fa9dbbe3ffe29217f673d12dd1200e05f96c2175feffc6fecc7f09fda4dd6bfa0ce7bef3d9372f6a534920
-
SSDEEP
24576:z0wz1d5bAbWhrc56zQ9T4Ole+5PIuklOjB:Hd5Vhr4IMTbeGPJHjB
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
-
-
Target
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.bin
-
Size
49KB
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
-
SHA1
5b063298bbd1670b4d39e1baef67f854b8dcba9d
-
SHA256
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
-
SHA512
b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
SSDEEP
768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
Score10/10-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-
-
-
Target
unpacked.mem
-
Size
72KB
-
MD5
108756f41d114eb93e136ba2feb838d0
-
SHA1
8c6b51923ee7da2f4642c7717db95fbb77d96164
-
SHA256
b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
-
SHA512
d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
SSDEEP
768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-