Resubmissions
20/10/2023, 17:39
231020-v8hpjafa7t20/10/2023, 17:06
231020-vms85sed8t1020/10/2023, 12:12
231020-pdg7macc7510Analysis
- max time kernel
140s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
20/10/2023, 17:06
General
- Target NEAS.d8f76885ca9af651befe9d9e2d00d340_JC.exe
- Size 173KB
- Sample231020-vms85sed8t
- SHA256 4a4c61d929d49cd5fce4872754993a9bd570566ca2b16d114f3664d86e09eb50
Malware Config
Extracted
-
C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT
- You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/xQsN7xb9 http://goldeny4vs3nyoht.onion/xQsN7xb9 3. Enter your personal decryption code there: xQsN7xb9RN2hV1wGv2XnRsz8hpvZVuazYLpbVkXp17QQo3VR2oVoT3iZfQwAdick2mtvbeQ4dEdFbv1HooGRk21ThAftz38J
-
http://golden5a4eqranh7.onion/xQsN7xb9
-
http://goldeny4vs3nyoht.onion/xQsN7xb9
Signatures
- Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
- Renames multiple (736) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d8f76885ca9af651befe9d9e2d00d340_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d8f76885ca9af651befe9d9e2d00d340_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{f0f50074-c2a7-4f4e-914b-7489d0e958ff}\eventvwr.exe"C:\Users\Admin\AppData\Roaming\{f0f50074-c2a7-4f4e-914b-7489d0e958ff}\eventvwr.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
eventvwr.exe
eventvwr.exe
eventvwr.exe
YOUR_FILES_ARE_ENCRYPTED.TXT
memory/2772-16-0x00000000006B0000-0x00000000006C1000-memory.dmp
memory/2772-14-0x00000000006A0000-0x00000000006AC000-memory.dmp
memory/2772-15-0x00000000006B0000-0x00000000006C1000-memory.dmp
memory/2772-882-0x00000000006B0000-0x00000000006C1000-memory.dmp
memory/2772-1495-0x00000000006B0000-0x00000000006C1000-memory.dmp
memory/3516-13-0x0000000000480000-0x000000000048C000-memory.dmp
memory/3516-12-0x00000000009F0000-0x0000000000A01000-memory.dmp
memory/3516-1-0x00000000009F0000-0x0000000000A01000-memory.dmp
memory/3516-0-0x0000000000480000-0x000000000048C000-memory.dmp