Analysis

  • max time kernel
    295s
  • max time network
    299s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/01/2024, 04:55

General

  • Target

    aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe

  • Size

    733KB

  • MD5

    95a407562c1f5ff8d8c1de430349eb99

  • SHA1

    638407b2f67ac47b69c5fa03b55144563e1c440d

  • SHA256

    aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293

  • SHA512

    d457d3275a4f0ee66a984b203e9fa5a1403e8f9ecbfd5e9cde11bab1e486fc0cb554cd05c6c892bf9ae59b7aada67eafca6a6deb39dd2051310fe757f28949e5

  • SSDEEP

    12288:UfLtmBByRWA5neQMR9wcJBzSco6zPIB8+5vTxAGuIQHBupiSoL9zX4w4GSYf:EtmBEwAw3zrBzSOzY5tNuJupiSoLZvv

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detect Vidar Stealer 5 IoCs
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe
    "C:\Users\Admin\AppData\Local\Temp\aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:308
    • C:\Users\Admin\AppData\Local\Temp\aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe
      "C:\Users\Admin\AppData\Local\Temp\aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:32
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\de28997d-8d73-409f-b4d4-a8479a7737a6" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2756
      • C:\Users\Admin\AppData\Local\Temp\aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe
        "C:\Users\Admin\AppData\Local\Temp\aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4764
  • C:\Users\Admin\AppData\Local\Temp\aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe
    "C:\Users\Admin\AppData\Local\Temp\aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe" --Admin IsNotAutoStart IsNotTask
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build2.exe
      "C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1648
    • C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build3.exe
      "C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build3.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build3.exe
        "C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build3.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4924
  • C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build2.exe
    "C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build2.exe"
    1⤵
    • Executes dropped EXE
    PID:4960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1912
      2⤵
      • Program crash
      PID:1884
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:3800
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3216
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:920
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:1912
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:4800
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:1288
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:1072
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4508

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          1KB

          MD5

          b7470a9aa569b259d4c2bb3b80ae3aa3

          SHA1

          093290296b7f1e402ef96e4b33a88f064aa401eb

          SHA256

          ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

          SHA512

          4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          724B

          MD5

          8202a1cd02e7d69597995cabbe881a12

          SHA1

          8858d9d934b7aa9330ee73de6c476acf19929ff6

          SHA256

          58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

          SHA512

          97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          410B

          MD5

          89ae2a06f6ef4b6df63a1d1a00100d57

          SHA1

          5524d132d54856c6c15dd362143978cd16ca33f8

          SHA256

          934634313744ba70fa34de947719b64ab4d5a55500b593fb5703704a3182b8c0

          SHA512

          343b52dffc04ddd75ec4f42f5bdf8f6129f2a7b45ed6d3cdcc7989236b6cf723c3422cd7efa8729c7c5fc419470b80f9d0882b1d4e434182c7b9183e4168dc3a

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          392B

          MD5

          6fe0ccb584239bd0d75208b5043fb272

          SHA1

          d9f0e1fd7b35ff3986b4cbe2ad738577863b4788

          SHA256

          a7848b992fcec6370e232b62640cb0765768e1b723ed392b3fadde3d34c5ffe0

          SHA512

          d99b524ec8bb5d85d1d7f4569debd9a6e3d8baef0d17ccd756b60cca789deead5b76bfc16f4ea1ad0985ce2714f498b5e9d23db9214af262ad1290097b569f05

        • C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build2.exe

          Filesize

          265KB

          MD5

          7d08821de6b860d813703ac8030bb8a6

          SHA1

          dd5d9275bb59f53b0721dbb260fa15839f16d6fa

          SHA256

          2b205a8936766885f7f93bcb6c0c0cced7678a22ab79525859f6c515635d26b3

          SHA512

          7b2657105010bdc2ba9a7ea05db5c46e87c45f908f62963f6e6749b402aed14977ca0f2f2b6659fc114a8034af77abb5af93bd4f1b44834f01958a81bec64b8b

        • C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build2.exe

          Filesize

          136KB

          MD5

          4470ae6d1fdd15e2ee1ee7cd5e367095

          SHA1

          a98ceeba1ad55b6c8a8306178e922e9efd9d4f05

          SHA256

          25e717b8b5f39d20acdd619cf15155f6a0cf5257302f7489276e4c8ec64175f1

          SHA512

          c707461376dd24885978bd60ffd936338bbdb85333ae7b2a308994c8039d632506ef0ce01585af9e189e84c68f86c399ae4c809e53897be22aaa34ed951168a5

        • C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build2.exe

          Filesize

          185KB

          MD5

          0db54f634f9a638b2bec2c602e97d52c

          SHA1

          30acccf74b2f5acb45daaf3c6f8b5ed1d081d149

          SHA256

          65c7ce17c1511f20321938530cce8d87961d5ca625d4db87c2bd6118ca55dd1e

          SHA512

          d9d6cd3edf4ab3a3b61b863ea27d3d6c1f9f26a3596bc8bb5a1608ebb68657e1a4dee605775daedfcf98867d19a9686cbf2ad7142faf065f9a3b10ea3a355027

        • C:\Users\Admin\AppData\Local\530bdbf9-aa10-4bae-b502-6a48d095c879\build3.exe

          Filesize

          299KB

          MD5

          41b883a061c95e9b9cb17d4ca50de770

          SHA1

          1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

          SHA256

          fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

          SHA512

          cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

        • C:\Users\Admin\AppData\Local\de28997d-8d73-409f-b4d4-a8479a7737a6\aa0d51394f696edbe195cb4e279f135f85a5acad6eed5d2cb542c06816cf2293.exe

          Filesize

          298KB

          MD5

          ba60132ec243d6706685ad319ddddcfb

          SHA1

          8072f04eaebb403359596ce41b3639b13fbba59c

          SHA256

          67734fa79f54ee897f01ba1d8316a6c58ce2d3846d505203849412b084d705cf

          SHA512

          4a92641de472153e582a79fa37977c8c5a11e084b1d51aaa5f7640381e20f5c148ca3cf1b4a7aba039a6030227092d99c8cb3eff2b5ef1eb22b448b129a4846f

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          214KB

          MD5

          d252d19a3a2e6e458bce14342a3322a8

          SHA1

          62764d56d888e35816425c80e41a5933633bc548

          SHA256

          3b712598960ee46835d5bd085b7da4e9b235da25d3b299e28b294af6b277c225

          SHA512

          c4e1f4a8550bbda3291feb155b05a5428761aef6b9968c60443c007a14bd0137d45e4f68de15a41d2ba85e26e0a449f1297f253ffc31a68af9c0a42acc24bb76

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          116KB

          MD5

          28a2a6e9f4adb79261e929ec6f1dc817

          SHA1

          e1e7940aae7cbb6f08d8642fd10a7da8764dde72

          SHA256

          920e6db6038bb4d006f7de2ebe05147be968bc4c68b35e8f617d6fab800e9342

          SHA512

          0bb02e2c7b7f57f3de754182eb1e50cc83f7db3f7538397a96c8b900056c7fe9396d951aba6516e9cfb847e205673dc675b33e268c21caed70bb35c211b10322

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          84KB

          MD5

          13f664830f31122210ed85c795847487

          SHA1

          0b39cc01bbb89261c2b3e0db4dd091fcc99a9ffc

          SHA256

          15694ccb0ae6829dcb4ba4225eb46ff766d8c3303d983cfc3554957c7b92177a

          SHA512

          1447bebf73b849ef2a97f4f302cdbc8e678eefaae7d2386ec5e96da5548d292dbb9920ffe4f69ff0e2b9f76964011789c717fded901ac10ce9ebc9be8f5c4c3f

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          102KB

          MD5

          c8a396d2eff0482c757d97a0f3f9a6da

          SHA1

          90152104157eb1c381757bb24a8e1455fbc9d216

          SHA256

          0f16a0ab2f4a07f517356787e5046ac2af0c0b021250cf178b1f7e1a7d8d802e

          SHA512

          89ca81bef0789b26531cfdaad751500c313ea82db8e0fc5c72526dad9b74f51ddf26d20bc8010066c6f1d1fe515a97da7d1d03b7d69e0e2e16242362f162dae4

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          162KB

          MD5

          96c537da5e32398b156de85720d9838f

          SHA1

          89fc76f360c09ee1597af616ff2acd43669f682f

          SHA256

          69bdddd91bdd75415d27b04b89a2dfd4d9f58c9527bad9a17d19586d57351b6c

          SHA512

          19cd60e1e8641e568aad4c88aa6167e961f64f1890cb5d7d4cf6c3b1a0fbeea053c3b1b48161ac6982d5feb5ca9ef72585a5cff43a099e6e1aac2fb13c7cc246

        • memory/32-6-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/32-17-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/32-1-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/32-5-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/32-3-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/308-2-0x0000000002140000-0x00000000021DE000-memory.dmp

          Filesize

          632KB

        • memory/308-4-0x00000000022D0000-0x00000000023EB000-memory.dmp

          Filesize

          1.1MB

        • memory/920-125-0x0000000000AD0000-0x0000000000BD0000-memory.dmp

          Filesize

          1024KB

        • memory/1072-180-0x000000000082E000-0x000000000083E000-memory.dmp

          Filesize

          64KB

        • memory/1648-49-0x0000000000460000-0x0000000000560000-memory.dmp

          Filesize

          1024KB

        • memory/1648-50-0x00000000020A0000-0x00000000020EB000-memory.dmp

          Filesize

          300KB

        • memory/1904-36-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-30-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-29-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-37-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-53-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-64-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-34-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-24-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-23-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-22-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2352-76-0x0000000000B49000-0x0000000000B5A000-memory.dmp

          Filesize

          68KB

        • memory/2352-77-0x0000000000920000-0x0000000000924000-memory.dmp

          Filesize

          16KB

        • memory/2464-103-0x0000000000A4A000-0x0000000000A5A000-memory.dmp

          Filesize

          64KB

        • memory/4764-20-0x0000000002040000-0x00000000020E2000-memory.dmp

          Filesize

          648KB

        • memory/4800-153-0x000000000091E000-0x000000000092E000-memory.dmp

          Filesize

          64KB

        • memory/4924-72-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/4924-78-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/4924-80-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/4960-66-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4960-51-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4960-52-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4960-46-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB