ekans | cd9c6bafeef092b670ea307caf9cd2aeb234e5232950be1181f24ab41a26a4d1

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 00:08

Target

212207f5a1eb39c861ff8b080ddcd2ef.exe
Size

3.6MB
MD5

212207f5a1eb39c861ff8b080ddcd2ef
SHA1

4613aa3cba20966b5ce95918893df9e5053d206d
SHA256

cd9c6bafeef092b670ea307caf9cd2aeb234e5232950be1181f24ab41a26a4d1
SHA512

0b341c34f0590e4a4dccc1100db2f83b63241bd8fb8f95a8185fa303a24fa53270a3ab76de5d7f22260545a84ec262c218f2e2ba89f660396c3b837df3b8eaed
SSDEEP

98304:aYhWM7csQQNHTdcf5KsQFHxmKUhgggggggWGqS9xkuDQZt/:aPMfzBdcU7FRahggggggg8S9xgZ9

Score

10^/10

Ekans
Variant of Snake Ransomware. Targets ICS infrastructure, known to have been used against Honda in June 2020.
ransomware ekans

Ekans Ransomware 1 IoCs

Executable looks like Ekans ICS ransomware sample.

resource	yara_rule
behavioral2/files/0x000300000001f45f-4.dat	family_ekans

Zebrocy
Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.
trojan backdoor zebrocy

Zebrocy Go Variant 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001f45f-4.dat	Zebrocy

Executes dropped EXE 1 IoCs

pid	Process
4016	1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	4016	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4016	4948	212207f5a1eb39c861ff8b080ddcd2ef.exe	89
PID 4948 wrote to memory of 4016	4948	212207f5a1eb39c861ff8b080ddcd2ef.exe	89
PID 4948 wrote to memory of 4016	4948	212207f5a1eb39c861ff8b080ddcd2ef.exe	89

C:\Users\Admin\AppData\Local\Temp\212207f5a1eb39c861ff8b080ddcd2ef.exe
"C:\Users\Admin\AppData\Local\Temp\212207f5a1eb39c861ff8b080ddcd2ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\1.exe
  1.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 276
    3⤵
    - Program crash
    PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4016 -ip 4016
1⤵
PID:4928

C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
3.6MB

MD5
3168f4d5cdc232eb6d65f5f2af9c249a

SHA1
caa8bc43ae9263acb1ab8bbbe2aca1b79b03cfb8

SHA256
d39e39d1cab8ed9295f52256df1229997d1f27c7c71939eb29b79cb329a73dc6

SHA512
851f969a13eddbf8a58ab41c4f970f0318499e86ff07b9e8b78bc281f00b4ebf76edb55f7d0e1962b230966c2c29f75a97bc7cc3031330b5185e5362732a02c6

Download Submit