Analysis

  • max time kernel
    298s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/01/2024, 04:51

General

  • Target

    58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe

  • Size

    759KB

  • MD5

    6f89ec245ea854d0e13e12be1b96c4c1

  • SHA1

    e4625c074a0e14f1df3f47370b8b2b7246afbfc4

  • SHA256

    58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b

  • SHA512

    60830f51d447b41bf6ea8c54e3cf07aa5285d2928bf302acfaf237693530a3e68704b05b59db92912e3f64858309dd754dc42a60a3f0c75d3a8c96a3678a2f1f

  • SSDEEP

    12288:R3U/qyAXBb9nFOtXy++zB71x3CmmtPV3B0BFAam3wZ0gkCCydbe:2/qyAx5FOUld7qmmx9CO5wZXkVy5e

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detect Vidar Stealer 8 IoCs
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe
    "C:\Users\Admin\AppData\Local\Temp\58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Users\Admin\AppData\Local\Temp\58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe
      "C:\Users\Admin\AppData\Local\Temp\58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\d991ce85-6fa1-4d89-903d-859047eaa94a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:768
      • C:\Users\Admin\AppData\Local\Temp\58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe
        "C:\Users\Admin\AppData\Local\Temp\58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Users\Admin\AppData\Local\Temp\58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe
          "C:\Users\Admin\AppData\Local\Temp\58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build2.exe
            "C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3860
          • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build3.exe
            "C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4012
            • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build3.exe
              "C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2196
  • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build2.exe
    "C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build2.exe"
    1⤵
    • Executes dropped EXE
    PID:1884
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 2072
      2⤵
      • Program crash
      PID:4888
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:1232
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3264
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:2920
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:3616
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:4884
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:3988
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:1636
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4944

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          1KB

          MD5

          b7470a9aa569b259d4c2bb3b80ae3aa3

          SHA1

          093290296b7f1e402ef96e4b33a88f064aa401eb

          SHA256

          ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

          SHA512

          4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          724B

          MD5

          8202a1cd02e7d69597995cabbe881a12

          SHA1

          8858d9d934b7aa9330ee73de6c476acf19929ff6

          SHA256

          58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

          SHA512

          97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          410B

          MD5

          0bf5dcd55d1bf70c75c40bec9e679d78

          SHA1

          bb06303922c337e33988dd59f72621a4f73dcc52

          SHA256

          f30da7f83c68d205f0ed7c388c627da4991377ce013b897daa67088309d0c0d1

          SHA512

          fa725d5f17ae4a98e84deba8e891afc2ac77e80347069dc6ef27a0d7b524b364778d609710faa033c6360d63206b11394847058a77384b2586f7066b4f7b287f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          392B

          MD5

          789c4f9e15f2dfc83e691c1b0adb9df3

          SHA1

          6328e86f30dc8792c911ee3860fb5cfa514937be

          SHA256

          60dbf7c296e4da0a7121c492e91c63dff784822db3f399b576272a03d7aead77

          SHA512

          e8c34fa47ffa463aea15f1eb0b0d8fa0f9dff5915ecbc65c82b721651804e40b8220297a8440e2c33ca3ff06f440a95fc59a4c1262c6078c3344459e3438a960

        • C:\Users\Admin\AppData\Local\d991ce85-6fa1-4d89-903d-859047eaa94a\58147f68d96505cd239782f1a6783d5f03825da44a58fb494801e03aec79cf6b.exe

          Filesize

          319KB

          MD5

          e22cc391ec96183337fa39658716d352

          SHA1

          6d42eeba5cdef2fbc22e5d0f775f2e848e7004fe

          SHA256

          55bc702d0f53bae786546193da6740f2bfc7999f03ebc7b7be76baf16a95ebd9

          SHA512

          67386103d2714077485318d6e48443b5459193b33c2ac4bd58cec08d5e05a7b6e39b18da5550d3ee192b397fa5a7818c0a92636dfce957c93f91b3355e0ca0ff

        • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build2.exe

          Filesize

          70KB

          MD5

          081abf7827e6bbdf42f3df0fe751d40f

          SHA1

          597be0cc3c2b541e61b84ef1e772e7d60387dfd3

          SHA256

          98785ba14bf41a1b043d2a3f27a7f40b3efbe58af4e0167394f867d6559c59c9

          SHA512

          0699b2ea49a74ea31772c21c967f999cd03af9ba49b55bf0e5a7c439a02dd7bb91ae5d90ef1c0eacf8a2b8765fd81d2a6f186ed7ca72f832ba2841afe5b36155

        • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build2.exe

          Filesize

          97KB

          MD5

          c4522c95d578ae0ce61bb5246e06fad9

          SHA1

          c4808003b653392e82282f427d2313f2549697fc

          SHA256

          c358c5e561605d7d093a42bf56ff6e7e0e0b90bfe06896dde5162e7215278fa6

          SHA512

          81e207793d553731d32a5e1fae82aaf17e55cebf6567b4caaac6592b670b6e5a5d1543af7f147744b8309cd357d116d1df49df8078f083320757fc7b35f73047

        • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build2.exe

          Filesize

          166KB

          MD5

          80466d1e3c1a8d321262938f6c86178b

          SHA1

          d735dd52915df87857efbd6c323fb327e6198f96

          SHA256

          25c9c2a23350fb899a793a24cdb32d971f33676b303ff25de2f8edd5c89dc0ba

          SHA512

          3825a00eda5e91a859f95de28755036dbd3c67f3d004cab2094be34fce71de7164a2a11581445b2c5c7dc206156d3d4009d3269bd25b95eb2ec28fa7d2ea4312

        • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build3.exe

          Filesize

          67KB

          MD5

          0c19c644888b16a4df5076f73b27916e

          SHA1

          76071db49d5c2f8ad81bd5d4a5803fe4e201502e

          SHA256

          9ce896dfc21f5a1f92439553ce1b419f34e684321e1864b52f6fd73c8d533014

          SHA512

          560ce9f62dc12a8ce34f9c6cf6e54d436e35b8855c9d5fa8c41b6164ed8870b249678ec15d3bc0ecd9348fc0eb9e25b0b9c6db21021bfe4d15de1d9a43fd9e88

        • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build3.exe

          Filesize

          144KB

          MD5

          43e8dcdf963318ec99324c8913783811

          SHA1

          59b47c2b52458f57d1b7360bc581493bbe639352

          SHA256

          a3f2c541cda7b170163b241505c6f86d03c3ab279c2881caa0ff837b03a7af4f

          SHA512

          4c3b5085c59c1c6f1858e619c6032a735196c604af5e7687986a5d0366b62a7e6380bf17fb8034e7df843f4b67bd170962bbabb049fccd21c6defd93ba697be3

        • C:\Users\Admin\AppData\Local\e4a0b80e-202e-4233-88db-190a8ae9411a\build3.exe

          Filesize

          41KB

          MD5

          9a8f5656d62d3fc8fe93a71bd3f98b6e

          SHA1

          746353f9c68752150cc2d9a8c5f76ba347d08b96

          SHA256

          38b519820e2c99239fdab16a36c9045f62d24bcb436dc3b924df8f0a5fa54e12

          SHA512

          dc3c490695e8a1899ecb776a0769ce8f9877a2400076c7caef742388ede8746b99e1d555d402216cee6dbfbdaee7a605df1fb0f9e548a6c19932cd7ad063b9eb

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          62KB

          MD5

          334373b5bdd0f5e9896cc72c810ab441

          SHA1

          c10ece55d561b6753bb78e89a4d74b2f4954aedf

          SHA256

          886172f58a393b58952d9e8423812eae1d78987f8f2dd89f07dec8e2fe7fccc6

          SHA512

          3673a099787d5369fd035c742ab112e2a88379758902b17a015a5374c7282c61b8bbc0f0e387f78a43ab7f1a7222e5c1158bf0e399f3f1e2271fc436065ae9c9

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          299KB

          MD5

          41b883a061c95e9b9cb17d4ca50de770

          SHA1

          1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

          SHA256

          fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

          SHA512

          cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

        • memory/220-1-0x00000000005A0000-0x0000000000634000-memory.dmp

          Filesize

          592KB

        • memory/220-3-0x00000000023A0000-0x00000000024BB000-memory.dmp

          Filesize

          1.1MB

        • memory/1320-45-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1320-23-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1320-29-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1320-34-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1320-37-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1320-36-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1320-24-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1320-63-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1320-22-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1320-30-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1636-170-0x0000000000B80000-0x0000000000C80000-memory.dmp

          Filesize

          1024KB

        • memory/1884-52-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/1884-53-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/1884-77-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/1884-49-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/2196-72-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2196-67-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2196-74-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2288-5-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2288-17-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2288-6-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2288-2-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2288-4-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2876-20-0x00000000021D0000-0x0000000002272000-memory.dmp

          Filesize

          648KB

        • memory/2920-116-0x0000000000980000-0x0000000000A80000-memory.dmp

          Filesize

          1024KB

        • memory/3040-91-0x00000000009C0000-0x0000000000AC0000-memory.dmp

          Filesize

          1024KB

        • memory/3616-121-0x0000000000410000-0x00000000004D5000-memory.dmp

          Filesize

          788KB

        • memory/3860-47-0x0000000000750000-0x0000000000850000-memory.dmp

          Filesize

          1024KB

        • memory/3860-48-0x00000000005B0000-0x00000000005FB000-memory.dmp

          Filesize

          300KB

        • memory/4012-68-0x0000000000910000-0x0000000000A10000-memory.dmp

          Filesize

          1024KB

        • memory/4012-70-0x00000000001F0000-0x00000000001F4000-memory.dmp

          Filesize

          16KB

        • memory/4884-143-0x00000000007F0000-0x00000000008F0000-memory.dmp

          Filesize

          1024KB