Analysis

  • max time kernel
    298s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/01/2024, 04:56

General

  • Target

    b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe

  • Size

    732KB

  • MD5

    ca106182fc4543131ef128b77f57c70a

  • SHA1

    26d5069dfabecd28077365ecdb2704a621527c96

  • SHA256

    b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5

  • SHA512

    04f911af74389114301acc580e6041f6350df4eceb1ad6dc6034bef75d388581391c37d83847adc61a8b83e9b68b72f17e2d1f2b4a185bc7efd2b03d92daba4f

  • SSDEEP

    12288:2L2LS6hjiwI975M/yK2YdeY0M2DbnRsN82298kZaZvmaifZSKANOx+D:2L2xn/yXNY0M0Vl6v1wZkNO0

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detect Vidar Stealer 7 IoCs
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe
    "C:\Users\Admin\AppData\Local\Temp\b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe
      "C:\Users\Admin\AppData\Local\Temp\b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\67df257f-d713-4b59-b128-cba8f0290b73" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:428
      • C:\Users\Admin\AppData\Local\Temp\b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe
        "C:\Users\Admin\AppData\Local\Temp\b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\Users\Admin\AppData\Local\Temp\b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe
          "C:\Users\Admin\AppData\Local\Temp\b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3328
          • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build2.exe
            "C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3164
            • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build2.exe
              "C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build2.exe"
              6⤵
              • Executes dropped EXE
              PID:4448
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 1900
                7⤵
                • Program crash
                PID:600
          • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build3.exe
            "C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1460
            • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build3.exe
              "C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2188
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                7⤵
                • Creates scheduled task(s)
                PID:4948
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:760
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:4312
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:4152
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4472
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:3784
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:3772
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:1296
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:1552

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          1KB

          MD5

          b7470a9aa569b259d4c2bb3b80ae3aa3

          SHA1

          093290296b7f1e402ef96e4b33a88f064aa401eb

          SHA256

          ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

          SHA512

          4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          724B

          MD5

          8202a1cd02e7d69597995cabbe881a12

          SHA1

          8858d9d934b7aa9330ee73de6c476acf19929ff6

          SHA256

          58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

          SHA512

          97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          410B

          MD5

          20096e6a0541be2b46c6d2c28cbf07ec

          SHA1

          0eff303fd4bc07c3f93d2a79264b9b64fe6ae2b6

          SHA256

          b1f09c268a40f45f44f8dd27ff7feffb407880bd0a205daa37ac9f6d98978795

          SHA512

          9c4c79f96ead2d93696801472b4b90ad3b7998a0a8352ddbcf71fd550fe15c460e89dd7cb84f9b8be5a0a92bee8715fe4fdc236cee536e749bfb84cd1ee6e1fd

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          392B

          MD5

          b3a322cb6a93e77085da1ca969af35db

          SHA1

          0b037d89c4225dd4b522c6e2feba2026de675a7c

          SHA256

          c2a540dee6b21c4898f55d5b8e296023db0faa8a70558704f0f25234d6053d9a

          SHA512

          5fa707f1d5ed14f796dcd6302bcffe3b7d87cd500daec5b840c63e5ae309964f35e8a9c7c06983b773ffe8edc448a324d44afd302e68722993077d41409bdc83

        • C:\Users\Admin\AppData\Local\67df257f-d713-4b59-b128-cba8f0290b73\b6e0b3fdd03c8e6da4709362e6c1dc95e5af4443a5bb6335ab848c1f26c0bee5.exe

          Filesize

          134KB

          MD5

          d5a834458597b28262d18882f84278d0

          SHA1

          a62e31c59e684b71a68cd5074f2cdb9e0dfca34a

          SHA256

          ad22974dda99487372a8642a1667ff924c858067fe840c6c53830dc83ddc0dd7

          SHA512

          1fe4817f515fd1db3b63a57ffa9cf4eec083acaf63803474a2b08f9eb875b9796630fa8587d423a1f15bde1af6211490f3ffa065dec80ef879afd3d0475cb892

        • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build2.exe

          Filesize

          298KB

          MD5

          87863828a7f23aa7905e9350d6057e72

          SHA1

          29c6d2e0c3fd2a75a91031749bdc94ddbe97b539

          SHA256

          d771f46e22a5c68ab6bf0556a7995ca40816c87d86bdbeb29ade67b0d8c81052

          SHA512

          066bc51a4607fbeb11d4d1a594ef9dcb0c3c4a29ae7aa826b7488695790f361ae1947b69e571ab92ca9d5a026bbc7bf6f248ada21dcfb81111d454d778862e00

        • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build2.exe

          Filesize

          215KB

          MD5

          79cf37f19c8e17e5a78d52942f95921f

          SHA1

          af75d887c46686560c419291296de38c10f47680

          SHA256

          6274fcccd97ae89dbd0e05511daf116a07d1c53c4c5feff1ce1e2471156b1f6f

          SHA512

          d09749ba10618af6f1637ef1e577ae0206a791b3aee8def8184a4b64f76576a4fb856af8256afce6b555fd53dea91ae9523dda300ed4ae16e05852c3df18a0ae

        • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build2.exe

          Filesize

          205KB

          MD5

          4f0d01681697168ee36a366894ae5ae6

          SHA1

          b0c3fd6bb18bfb7fea9a626aff8435ddb134d6a2

          SHA256

          5a97da51a0f2f9bc025377bd4a2d5b1e3137e2685e940670f289da3478f2ad5a

          SHA512

          0615c67f5e643704ba6400f39426c7aed3865c827a239bed16216bddf425d177cbf966499827a082e979f80b92e0d919841b714cd759fd017d7447ae9df9508a

        • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build3.exe

          Filesize

          141KB

          MD5

          7e787293bb6b0a851581ba67d566d7bc

          SHA1

          061efbe25967e3671902dad4b25a26797ea75178

          SHA256

          2a39a0ef3ef569e4702e1238a9551b1283b729b5fac9ee5a988542666e3ba36b

          SHA512

          083b5409aa33475d889c3c2631232c3c8f76f33563cd496e25ad76be125f0287e08bf70773c8eece487a5f51da2cf1a4287878a4291c68d78393a58749e64d03

        • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build3.exe

          Filesize

          168KB

          MD5

          be01967fb815cbe54f7e4658d230330f

          SHA1

          fe59633a5375845c5121ea8a890b893f3ec74b18

          SHA256

          649344f585a69eafc0cb854e6e8d7f0cf478eb6bc1a3c81351f336fffe03ce02

          SHA512

          781fa81945847155e3878fcd236bc2d79d8bc65fbcbdcba57a0fc2a7a7ebb7e8482fee19b7aa4f3de12b217cc1a30c25e96964cf6cd531444831abd0557bc285

        • C:\Users\Admin\AppData\Local\b019cc69-5a6c-47a7-8ad8-20c3a2b37473\build3.exe

          Filesize

          173KB

          MD5

          7befa1c4ff23c0b3b4c5adcd9417b247

          SHA1

          fc4cf9ed7d3c7f147a67746ebf01ea3fab4a1cc9

          SHA256

          b80836568a99e1c6cab7073831e64bbf3eb09ee1dc5dca5623fdcd3019f520f0

          SHA512

          63f97146440f5c0f9c755d06ef43a6e94ef39c5f80a99ea277a8939702416ac007b779d63c65447e2ecfdd1e3089e6ccab1b20aeacbdb4c88c70d1732236c50e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          227KB

          MD5

          af35afdc152c8797a5510e1d71291187

          SHA1

          ac96cb475c4e04038423cfa53e63ae76b269e053

          SHA256

          ddab7d806ad42adc7fc3fc764df6eae87f47c96e304ead0c3b686e072ab40329

          SHA512

          424c09ce568faba9bcd3e2a56f7d88b5e2581aff1bb3d46648394536933fd99a07c52432757a615aa16efee0809079ab0abf630b37cde0620423b7d21ba650ae

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          291KB

          MD5

          99250f97f6f7b69b9e88b546b579c2e9

          SHA1

          c3f0c6b90a28ff6f70aaa26e7ea904e95229149c

          SHA256

          7cd197f2a5e79cc1927d745ac6a39e91dc03c11f51c23b5844c2065c87509661

          SHA512

          f9ef00d9fb489fef04ea5179f35a30b516f21b79822ea0980c58d0486d78af41f6ba41878913be76b26161d0e07a1ecd155f3369e7f1812746645dab70b46175

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          57KB

          MD5

          74ae9689cb04bde426e036319feeb49b

          SHA1

          b932fd3571f6113cacf1e5eb2b3453a05887963c

          SHA256

          b59f5c8dc70d0092f4257c3e13745f67e6324edeee709eff32336d3c93bca180

          SHA512

          642d69ab7ef11418b9d97cfa8882ba38ba5c08fcec428a8a758b9de8ee1d576b4d1fe1a2ca93dc4f1f5e6a8eba8c21f7309975c0c43033350d51e5efe7fcafca

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          299KB

          MD5

          41b883a061c95e9b9cb17d4ca50de770

          SHA1

          1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

          SHA256

          fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

          SHA512

          cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

        • memory/832-101-0x0000000000880000-0x0000000000980000-memory.dmp

          Filesize

          1024KB

        • memory/1296-178-0x00000000009E0000-0x0000000000AE0000-memory.dmp

          Filesize

          1024KB

        • memory/1460-77-0x0000000000B59000-0x0000000000B6A000-memory.dmp

          Filesize

          68KB

        • memory/1460-78-0x0000000000920000-0x0000000000924000-memory.dmp

          Filesize

          16KB

        • memory/2160-3-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2160-5-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2160-17-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2160-6-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2160-4-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2188-79-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2188-82-0x0000000000410000-0x00000000004D5000-memory.dmp

          Filesize

          788KB

        • memory/2188-73-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2188-81-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2492-1-0x00000000006B0000-0x0000000000749000-memory.dmp

          Filesize

          612KB

        • memory/2492-2-0x00000000021F0000-0x000000000230B000-memory.dmp

          Filesize

          1.1MB

        • memory/2936-20-0x0000000000720000-0x00000000007BE000-memory.dmp

          Filesize

          632KB

        • memory/3164-51-0x00000000006F0000-0x00000000007F0000-memory.dmp

          Filesize

          1024KB

        • memory/3164-53-0x00000000005C0000-0x000000000060B000-memory.dmp

          Filesize

          300KB

        • memory/3164-70-0x00000000005C0000-0x000000000060B000-memory.dmp

          Filesize

          300KB

        • memory/3328-34-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3328-30-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3328-65-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3328-23-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3328-22-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3328-24-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3328-38-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3328-36-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3328-37-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3328-29-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3784-151-0x0000000000ABE000-0x0000000000ACE000-memory.dmp

          Filesize

          64KB

        • memory/4152-124-0x00000000009F0000-0x0000000000AF0000-memory.dmp

          Filesize

          1024KB

        • memory/4448-67-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4448-48-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4448-52-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4448-54-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB