djvu | b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877

Analysis

max time kernel
297s
max time network
294s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
14/01/2024, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe
Size 811KB
Sample240114-2bwnfsecf9
SHA256 b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877
MD5 9244e8dafdb3baa6ebbf1eed741fc1bb
SHA1 ad7620174b2d4ac4461f1d8623e632e4b63fa867
SHA512 c5e79d0f52bf4cf374f86325d4be819573e9cbad4afe57d164c83ce2806095c76b81a7f34dbfe71a64b29563c289a4b872a61459fbc7d9da16308eb0798a10b8
SSDEEP 12288:QpoaBPg7lN6/RFLeoA03fdZh+UwvL1hd4JMuUzgAl8F5bLlt89SOUx5ruaBsi:OgR4XCXcsphd4JMh8vdt896xAaBs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu vidar discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://zexeq.com/test1/get.php

Attributes

extension
.cdwe
offline_id
dSwr1XNNi5cIitB5eDPbMANcusB1dWGDB8ToUnt1
payload_url
http://brusuax.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-e21iz7dS58 Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0842ASdw

rsa_pubkey.plain

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral2/memory/2420-40-0x00000000020D0000-0x000000000211B000-memory.dmp	family_vidar_v6
behavioral2/memory/204-41-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral2/memory/204-45-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral2/memory/204-46-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral2/memory/204-51-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6

Detected Djvu ransomware 16 IoCs

resource	yara_rule
behavioral2/memory/1488-2-0x0000000002610000-0x000000000272B000-memory.dmp	family_djvu
behavioral2/memory/2312-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2312-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2312-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2312-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2312-17-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-44-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-53-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-55-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-56-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4816-58-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2420	build2.exe
204	build2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4608	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1682406436-2801920780-981986064-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\22bff576-a1f0-4011-a6fe-c5b3ec07966e\\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe\" --AutoStart"	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.2ip.ua
2	api.2ip.ua
12	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 3980 set thread context of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 2420 set thread context of 204	2420	build2.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4276	204	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2312	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe
2312	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe
4816	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe
4816	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 1488 wrote to memory of 2312	1488	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	73
PID 2312 wrote to memory of 4608	2312	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	74
PID 2312 wrote to memory of 4608	2312	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	74
PID 2312 wrote to memory of 4608	2312	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	74
PID 2312 wrote to memory of 3980	2312	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	75
PID 2312 wrote to memory of 3980	2312	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	75
PID 2312 wrote to memory of 3980	2312	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	75
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 3980 wrote to memory of 4816	3980	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	77
PID 4816 wrote to memory of 2420	4816	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	78
PID 4816 wrote to memory of 2420	4816	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	78
PID 4816 wrote to memory of 2420	4816	b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe	78
PID 2420 wrote to memory of 204	2420	build2.exe	79
PID 2420 wrote to memory of 204	2420	build2.exe	79
PID 2420 wrote to memory of 204	2420	build2.exe	79
PID 2420 wrote to memory of 204	2420	build2.exe	79
PID 2420 wrote to memory of 204	2420	build2.exe	79
PID 2420 wrote to memory of 204	2420	build2.exe	79
PID 2420 wrote to memory of 204	2420	build2.exe	79
PID 2420 wrote to memory of 204	2420	build2.exe	79
PID 2420 wrote to memory of 204	2420	build2.exe	79
PID 2420 wrote to memory of 204	2420	build2.exe	79

C:\Users\Admin\AppData\Local\Temp\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe
"C:\Users\Admin\AppData\Local\Temp\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe
  "C:\Users\Admin\AppData\Local\Temp\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\22bff576-a1f0-4011-a6fe-c5b3ec07966e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe
    "C:\Users\Admin\AppData\Local\Temp\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe
      "C:\Users\Admin\AppData\Local\Temp\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\Users\Admin\AppData\Local\8932e919-70a5-4c7c-b312-a51f6c06e56f\build2.exe
        
        "C:\Users\Admin\AppData\Local\8932e919-70a5-4c7c-b312-a51f6c06e56f\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2420
      - C:\Users\Admin\AppData\Local\8932e919-70a5-4c7c-b312-a51f6c06e56f\build2.exe
        
        "C:\Users\Admin\AppData\Local\8932e919-70a5-4c7c-b312-a51f6c06e56f\build2.exe"
        6⤵
        Executes dropped EXE
        
        PID:204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 1904
        7⤵
        Program crash
        
        PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 0da3f6452b91947ed4ad5e11a34cb348a7da0276e2ee8f8f27d5f3b3987dd1bd
MD5 3b8718bd7867f0d32922fc6eb112e52f
SHA1 f2667fa1606dbb70afd3a265a94badd166cf84d6
SHA512 547ddb54df5a51317868ba80164c05e706d0e8900a1db228af4c5c3cb4297e2fe4ecd65a67d83eb797c23217cb1246f07bd3848b5c97b7c7df37ee270e93ebd7
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 98af7312b9b487cec7bd902b7438052d9b76bd1d6a21b444a3389f5bb2d3fbb1
MD5 900c684a5ca51af4a973481b499769d4
SHA1 acd5f165aa991f9b28beea72dcf8018142fd659d
SHA512 733ea99768842041bfdda8bdf46b66baaea54c6cb38af6d59f42d263d456fdccd11d048058ac4edf53202b2eb940622ae001e6e7189eb13f1e4d52c84ca05f95
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 0cb10008f61661141291a3ee445df0758fb46dcd3eadb0837e37bc586e8a52b6
MD5 503bb03dea0e1ef6f4ed3f8f32bbd106
SHA1 74ecac0539a6d667b34abca9ed376c72a1ac394c
SHA512 9bd4c665246bdaa159e55d51716ee626ecf2c8f5ca8f033b470c390ed8a8f4d3d7d830e3b189a53ed186ccb20391f05062989eee44d71bd58d3056241b367b8f
MD5 SHA1 SHA512

Submit Download

b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe

Path C:\Users\Admin\AppData\Local\22bff576-a1f0-4011-a6fe-c5b3ec07966e\b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877.exe
Size 811KB
SHA256 b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877
MD5 9244e8dafdb3baa6ebbf1eed741fc1bb
SHA1 ad7620174b2d4ac4461f1d8623e632e4b63fa867
SHA512 c5e79d0f52bf4cf374f86325d4be819573e9cbad4afe57d164c83ce2806095c76b81a7f34dbfe71a64b29563c289a4b872a61459fbc7d9da16308eb0798a10b8
SSDEEP 12288:QpoaBPg7lN6/RFLeoA03fdZh+UwvL1hd4JMuUzgAl8F5bLlt89SOUx5ruaBsi:OgR4XCXcsphd4JMh8vdt896xAaBs
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path C:\Users\Admin\AppData\Local\8932e919-70a5-4c7c-b312-a51f6c06e56f\build2.exe
Size 358KB
SHA256 26063c78e5418610471a9f3a00a155d7d1e5b29856e1979ba3bdc42681a871d0
MD5 c4070da9f9b0581171af16e681ccdff8
SHA1 3fb4182921fdc3acd7873ebe113ac5522585312a
SHA512 c7569cea7f1a841e7cac9cd41287dba3bcacf2cf9dee7bece88800848a7ad5dc4cd2bdc896c7389f0f1144079bbe168048b3f722bcd76fa5d6e14f3081bb6427
SSDEEP 6144:pfLgtyckjU51Vc7lLUvTlR2agQAYNMQSnjbeg:pfMtycGU5/klLUvTlR5Aiuv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/204-41-0x0000000000400000-0x000000000065E000-memory.dmp

Download

memory/204-51-0x0000000000400000-0x000000000065E000-memory.dmp

Download

memory/204-46-0x0000000000400000-0x000000000065E000-memory.dmp

Download

memory/204-45-0x0000000000400000-0x000000000065E000-memory.dmp

Download

memory/1488-2-0x0000000002610000-0x000000000272B000-memory.dmp

Download

memory/1488-1-0x0000000002550000-0x00000000025E4000-memory.dmp

Download

memory/2312-6-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2312-4-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2312-3-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2312-5-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2312-17-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2420-40-0x00000000020D0000-0x000000000211B000-memory.dmp

Download

memory/2420-39-0x00000000006F0000-0x00000000007F0000-memory.dmp

Download

memory/3980-20-0x00000000023B0000-0x0000000002445000-memory.dmp

Download

memory/4816-30-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4816-24-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4816-23-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4816-44-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4816-22-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4816-29-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4816-53-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4816-55-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4816-56-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4816-58-0x0000000000400000-0x0000000000537000-memory.dmp

Download