Overview

overview

10

Static

static

10

cd4b456646...a3.exe

windows7-x64

10

cd4b456646...a3.exe

windows10-2004-x64

10

out.exe

windows7-x64

3

out.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    1s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2024 12:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cd4b4566460611a2dfa75f755270d5b2f56edff3d50a9ef6be8b3c92728c46a3.exe

  • Size

    2.2MB

  • MD5

    664351f9e645e79cdf17d8bb859ef8e5

  • SHA1

    6f45ee1f3246318d94368de97648245718de795d

  • SHA256

    cd4b4566460611a2dfa75f755270d5b2f56edff3d50a9ef6be8b3c92728c46a3

  • SHA512

    ccd49da2df1fdc3e789000709ce871abe6c90c98842040d818c343d04a165eade662433483e1ea1891c43d099616a29dced57d483cdd35d7642ed30ae66995a1

  • SSDEEP

    49152:kZxdq3f7AohAROoPkMrZVOGeBPEwSX+gyJ7I1Pud1w7pVJ9EluMH3opjhKa70I3Q:kOPhAooPkMnoI+gyJuJ7DJSluMHOjhji

Score
10/10
snatchransomwareupx

Malware Config

Signatures

  • Detecting the common Go functions and variables names used by Snatch ransomware 3 IoCs
  • Snatch Ransomware

    Ransomware family generally distributed through RDP bruteforce attacks.

    ransomwaresnatch
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\SysWOW64\findstr.exe
    FINDSTR SERVICE_NAME
    1⤵
      PID:1516
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\hqmgpfvmsiectbminp.bat
      1⤵
        PID:840
      • C:\Windows\SysWOW64\sc.exe
        SC QUERY
        1⤵
        • Launches sc.exe
        PID:848
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\cgwyymsjom.bat
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3044
      • C:\Users\Admin\AppData\Local\Temp\cd4b4566460611a2dfa75f755270d5b2f56edff3d50a9ef6be8b3c92728c46a3.exe
        "C:\Users\Admin\AppData\Local\Temp\cd4b4566460611a2dfa75f755270d5b2f56edff3d50a9ef6be8b3c92728c46a3.exe"
        1⤵
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\hjqiaoxiv.bat
          2⤵
            PID:1040
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\hcurmheqgru.bat
            2⤵
              PID:1508
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
              PID:496
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin delete shadows /all /quiet
              1⤵
              • Interacts with shadow copies
              PID:784

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2928-0-0x0000000000400000-0x0000000000807000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2928-10798-0x0000000000400000-0x0000000000807000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2928-10813-0x0000000000400000-0x0000000000807000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2928-16685-0x0000000000400000-0x0000000000807000-memory.dmp

              Filesize

              4.0MB

              Download