Overview

overview

10

Static

static

3

5950b4e275...cd.exe

windows7-x64

10

5950b4e275...cd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    9s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2023 19:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe

  • Size

    5.4MB

  • MD5

    3d29e9cdd2a9d76e57e8a3f9e6ed3643

  • SHA1

    5ad94f5303aed57a9d4f0055f15076454840064a

  • SHA256

    5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd

  • SHA512

    942bbbdbaf823329d65dd5ae58a2ec6098b5b35203523aae2c4bf47875730f346e0511a38983dfa8d9673752a546a5bfb4690a145d17a7d2b03f6fe8c659403f

  • SSDEEP

    98304:R4Hf6JMfWTMVWWqoMVBk+B4D79mXPepfDgsC8yVP2SuxHf846FAP01B7ZVzO:R4HFtqrVm+B4D7k94LHf8FAKc

Score
10/10
snatchransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT

Ransom Note
We inform you that your network has undergone a penetration test, during which we encrypted your files and downloaded more than 250 GB of your and your customers data, including: Marketing data Accounting Confidentional documents Personal data Copy of some mailboxes Databases backups Important! Do not try to decrypt the files yourself or using third-party utilities. The only program that can decrypt them is our decryptor, which you can request from the contacts below. Any other program will only damage files in such a way that it will be impossible to restore them. You can get all the necessary evidence, discuss with us possible solutions to this problem and request a decryptor by using the contacts below. Please be advised that if we don't receive a response from you within 3 days, we reserve the right to publish files to the public. Contact me: [email protected] or [email protected] Additional ways to communicate in tox chat tox id: A2DCDE8AAC5AB15F552621CF24A44A708EDFD0C89E22AE77087FA1E2F4FA057ABDD292BA6259 =========================================================== Customer service TOX ID: 0FF26770BFAEAD95194506E6970CC1C395B04159038D785DE316F05CE6DE67324C6038727A58 Only emergency! Use if support is not responding

Signatures

  • Detecting the common Go functions and variables names used by Snatch ransomware 13 IoCs
  • Snatch Ransomware

    Ransomware family generally distributed through RDP bruteforce attacks.

    ransomwaresnatch
  • Renames multiple (57) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe
    "C:\Users\Admin\AppData\Local\Temp\5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\system32\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\dbjlisifgpgwxgqg.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Windows\system32\sc.exe
        SC QUERY
        3⤵
        • Launches sc.exe
        PID:2828
      • C:\Windows\system32\findstr.exe
        FINDSTR SERVICE_NAME
        3⤵
          PID:2652
      • C:\Windows\system32\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\dbjyaspctnnytdtwgggy.bat
        2⤵
          PID:2680

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT
        Filesize

        1KB

        MD5

        51c08d5554f9f1f08ae6d6459418f5cf

        SHA1

        5f3b81daf238348c3d85c5558aa2d44ae1925328

        SHA256

        032b6e54166e5621813dea997d5186db8762985a714601f19fa6ef8fdd7370a2

        SHA512

        6300cf927c70e6757028b489cad2eba0d2a9a0de2e09ce367d584491a9a11a374bc26c630620ee409ebc39a3b6ad81f23021001763a10de810cc3d95fd6e3238

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\dbjlisifgpgwxgqg.bat
        Filesize

        43B

        MD5

        55310bb774fff38cca265dbc70ad6705

        SHA1

        cb8d76e9fd38a0b253056e5f204dab5441fe932b

        SHA256

        1fbdb97893d09d59575c3ef95df3c929fe6b6ddf1b273283e4efadf94cdc802d

        SHA512

        40e5a5e8454ca3eaac36d732550e2c5d869a235e3bbc4d31c4afa038fe4e06f782fa0885e876ad8119be766477fdcc12c1d5d04d53cf6b324e366b5351fc7cd4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\dbjlisifgpgwxgqg.bat
        Filesize

        43B

        MD5

        55310bb774fff38cca265dbc70ad6705

        SHA1

        cb8d76e9fd38a0b253056e5f204dab5441fe932b

        SHA256

        1fbdb97893d09d59575c3ef95df3c929fe6b6ddf1b273283e4efadf94cdc802d

        SHA512

        40e5a5e8454ca3eaac36d732550e2c5d869a235e3bbc4d31c4afa038fe4e06f782fa0885e876ad8119be766477fdcc12c1d5d04d53cf6b324e366b5351fc7cd4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\dbjyaspctnnytdtwgggy.bat
        Filesize

        47B

        MD5

        2202e846ba05d7f0bb20adbc5249c359

        SHA1

        4115d2d15614503456aea14db61d71a756cc7b8c

        SHA256

        0965cb8ee38adedd9ba06bdad9220a35890c2df0e4c78d0559cd6da653bf740f

        SHA512

        cd6ce6d89a8e5f75724405bc2694b706819c3c554b042075d5eb47fdb75653235160ac8a85e7425a49d98f25b3886faaaec5599bcf66d20bf6115dc3af4ba9c7

        Download Submit

      • memory/1824-16-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-572-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-24-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-15-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-14-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-34-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-1-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1824-573-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-574-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-575-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-580-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-593-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1824-594-0x00000000026E0000-0x0000000002BC0000-memory.dmp

        Filesize

        4.9MB

        Download