sapphire | e97941f812323e05ba4e83b138e8bb794b88efcd56980d07313b5acc965b2661

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20-09-2023 01:42

Target

6f0c4424cc7e35b379e69a6e6d553baf.exe
Size

46KB
MD5

6f0c4424cc7e35b379e69a6e6d553baf
SHA1

bf35bbf6c015b3a9d5498e6998e5269a6c129629
SHA256

e97941f812323e05ba4e83b138e8bb794b88efcd56980d07313b5acc965b2661
SHA512

8dcddb5a2de347344141797adcf46dff3b880e716130a8c23b5b626f14f16afb85d752071ee9a2fd3fee04007a99849866fd84c2cb61ab21dcf097cd7a943507
SSDEEP

768:oDFYuu3i50AOO0jhTlg4dPyLjavI7BnVI3ZTLZhoEI6b8WPmyc5:oDdMikjgaPyLjaw7I35Nb8smyc5

Score

10^/10

Family

sapphire

https://api.telegram.org/bot6228811625:AAHLiy2oFkwv-27FAk5KqltothFkPnNRSL8/sendMessage?chat_id=

Attributes

payload_url
https://cdn.discordapp.com/attachments/1023018120211869706/1082072513267380274/DotNetZip.dll

Sapphire Ransomware
French-language ransomware and stealer identified in May 2020 written in C#.
ransomware stealer sapphire

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	2420	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	6f0c4424cc7e35b379e69a6e6d553baf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2992	2420	6f0c4424cc7e35b379e69a6e6d553baf.exe	29
PID 2420 wrote to memory of 2992	2420	6f0c4424cc7e35b379e69a6e6d553baf.exe	29
PID 2420 wrote to memory of 2992	2420	6f0c4424cc7e35b379e69a6e6d553baf.exe	29
PID 2420 wrote to memory of 2992	2420	6f0c4424cc7e35b379e69a6e6d553baf.exe	29

C:\Users\Admin\AppData\Local\Temp\6f0c4424cc7e35b379e69a6e6d553baf.exe
"C:\Users\Admin\AppData\Local\Temp\6f0c4424cc7e35b379e69a6e6d553baf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 992
  2⤵
  - Program crash
  PID:2992

memory/2420-0-0x0000000000F30000-0x0000000000F42000-memory.dmp

Filesize
72KB

Download
memory/2420-1-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/2420-2-0x0000000000BD0000-0x0000000000C10000-memory.dmp

Filesize
256KB

Download
memory/2420-3-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/2420-4-0x0000000000BD0000-0x0000000000C10000-memory.dmp

Filesize
256KB

Download