sapphire | e97941f812323e05ba4e83b138e8bb794b88efcd56980d07313b5acc965b2661

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 14:54

Target

Sapphire2.exe
Size

46KB
MD5

6f0c4424cc7e35b379e69a6e6d553baf
SHA1

bf35bbf6c015b3a9d5498e6998e5269a6c129629
SHA256

e97941f812323e05ba4e83b138e8bb794b88efcd56980d07313b5acc965b2661
SHA512

8dcddb5a2de347344141797adcf46dff3b880e716130a8c23b5b626f14f16afb85d752071ee9a2fd3fee04007a99849866fd84c2cb61ab21dcf097cd7a943507
SSDEEP

768:oDFYuu3i50AOO0jhTlg4dPyLjavI7BnVI3ZTLZhoEI6b8WPmyc5:oDdMikjgaPyLjaw7I35Nb8smyc5

Score

10^/10

Family

sapphire

https://api.telegram.org/bot6228811625:AAHLiy2oFkwv-27FAk5KqltothFkPnNRSL8/sendMessage?chat_id=

Attributes

payload_url
https://cdn.discordapp.com/attachments/1023018120211869706/1082072513267380274/DotNetZip.dll

Sapphire Ransomware
French-language ransomware and stealer identified in May 2020 written in C#.
ransomware stealer sapphire

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	3068	WerFault.exe	17

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	Sapphire2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1692	3068	Sapphire2.exe	28
PID 3068 wrote to memory of 1692	3068	Sapphire2.exe	28
PID 3068 wrote to memory of 1692	3068	Sapphire2.exe	28
PID 3068 wrote to memory of 1692	3068	Sapphire2.exe	28

C:\Users\Admin\AppData\Local\Temp\Sapphire2.exe
"C:\Users\Admin\AppData\Local\Temp\Sapphire2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1092
  2⤵
  - Program crash
  PID:1692

memory/3068-0-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

Filesize
72KB

Download
memory/3068-1-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/3068-2-0x0000000000AC0000-0x0000000000B00000-memory.dmp

Filesize
256KB

Download
memory/3068-3-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/3068-4-0x0000000000AC0000-0x0000000000B00000-memory.dmp

Filesize
256KB

Download