Analysis

  • max time kernel
    296s
  • max time network
    295s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/01/2024, 04:58

General

  • Target

    cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe

  • Size

    723KB

  • MD5

    0407f464f5383cc888945bda2afa42c6

  • SHA1

    92de3404b2b42c0460565201ceaf2669bd6fc149

  • SHA256

    cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20

  • SHA512

    39aabd70c7065714718c0cb91795b1e690972780e1c118cb0f71f7f481f889f1df36b2e4b17b2e791ac8ef477c69f412a00f51bde9eec9e3c7531498c5586e50

  • SSDEEP

    12288:qKWz9fNdRDFUssQkmmhlew/2NSFaanti7JDaDN79dOCOMW+/jeV/sJ/oftN2y2Eh:nQ9pDFUs1kzhlew/uSFBtilDaDNpd3xE

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detect Vidar Stealer 6 IoCs
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe
    "C:\Users\Admin\AppData\Local\Temp\cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:308
    • C:\Users\Admin\AppData\Local\Temp\cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe
      "C:\Users\Admin\AppData\Local\Temp\cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3272
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\0ca184b1-f8d1-4848-a898-ec231c7e2c84" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2888
      • C:\Users\Admin\AppData\Local\Temp\cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe
        "C:\Users\Admin\AppData\Local\Temp\cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4752
        • C:\Users\Admin\AppData\Local\Temp\cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe
          "C:\Users\Admin\AppData\Local\Temp\cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1152
          • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build2.exe
            "C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1084
          • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build3.exe
            "C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4980
            • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build3.exe
              "C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:656
  • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build2.exe
    "C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build2.exe"
    1⤵
    • Executes dropped EXE
    PID:4812
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1892
      2⤵
      • Program crash
      PID:3320
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:4016
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        3⤵
        • Creates scheduled task(s)
        PID:4264
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:3056
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4112
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:2068
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:3224
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:4784
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:2400
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    PID:2596

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          1KB

          MD5

          b7470a9aa569b259d4c2bb3b80ae3aa3

          SHA1

          093290296b7f1e402ef96e4b33a88f064aa401eb

          SHA256

          ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

          SHA512

          4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          724B

          MD5

          8202a1cd02e7d69597995cabbe881a12

          SHA1

          8858d9d934b7aa9330ee73de6c476acf19929ff6

          SHA256

          58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

          SHA512

          97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          410B

          MD5

          540a525ffcb6adde1143935b0b511f8a

          SHA1

          340effb7c73f3e55693aca20da3df37f731eef30

          SHA256

          d2ecd05737ef0b704c57a8bae19800e0e8371c462b4ca9885b5f5a215b0c6138

          SHA512

          3eb858280f5db3b121482fca7f2ec6cd1d91e96235fdd6ce557befaf233521764a2f0acd393ead6cd7f2e37ad4b988da2fb7e0cd5b167cf657522377280b5dd7

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          392B

          MD5

          1e7a741c654eefa9b727007204b618ca

          SHA1

          402f6317db245b32f588715e777c5332376f8657

          SHA256

          93fd640a2e477ecce0b855f2e14bafbffe8b99edacc4bf6286f5affb547c9bb5

          SHA512

          c77206c96be186be826cd8846b7b5776b0611593c80d76ec3013adcfafb32ce8171aa9c4b6e0ef953c45dee0fafee1caf24d4ba61d58705d0f91eb8e4d3400ec

        • C:\Users\Admin\AppData\Local\0ca184b1-f8d1-4848-a898-ec231c7e2c84\cc44b762d57a9c109e4255cb94fd3f550a18bc005a45aaed1ac9c99d806e6c20.exe

          Filesize

          78KB

          MD5

          05ddd0423edaa09a6cbf5c74009f8320

          SHA1

          b0c3d52b01e9648091a76109b285594efa69a88e

          SHA256

          77d58941471464e62191521db914250ffbff12dbe0cb59c6d4fb9c35f9d9c4de

          SHA512

          0634e756f5e945975b4920aed6bd5e99a4b9b2f077423f0ae960c460c2608672b274b67c19885342f83122c9fd9f2fb6fd77bbffa3fad7cb33a402972fe78a32

        • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build2.exe

          Filesize

          92KB

          MD5

          387a5267ce9252f07afd1748d49b9303

          SHA1

          2cbf78869ad9664e98a83d6c16e288b9ede47161

          SHA256

          cf65da08b8bd5ea5ae0682e7e529b3ceeb0e9594ead2916fdfd15fa352b8a2aa

          SHA512

          a7328aa660eb231b7ff55e7c0459a114e26ef2f7699298b4e165907c41716d77a0f54ed369666e533fdc57f822271689c964388122ac7b781b91729160c2fb92

        • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build2.exe

          Filesize

          37KB

          MD5

          3b68b0988c7c4a357269f04c7740ffdd

          SHA1

          f2a95436364eb11212124cca5ecbcc67106bee11

          SHA256

          14ebb7750d68b3ef8ce582ea8130c325b419b033a2b1268146407a98862c911f

          SHA512

          f0e5683366dc1aec6fa12185de707d8c3f713168e192ad20835a441166fb5e3bb316751e3e2009761a63a955f1891d5b8f4a94e2f64ce14d8b5478596ab04f82

        • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build2.exe

          Filesize

          58KB

          MD5

          245d3e63bfa3faaf90f5461a730f0c6d

          SHA1

          14f3d81e55216c1311a5adb9926f370dd1fea64a

          SHA256

          41a0b4ce4aa044feda4d84a9010f66a1b135a59a9daae510e63191a3d922d429

          SHA512

          a585e38181e15f6769c8a09c50f94f85550ad1854dae0bbc69894664a8062ef30832c9a41093a0e1f24521673ab88fda5ad4fc20d1db7b0129edf7b81322cdb2

        • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build3.exe

          Filesize

          64KB

          MD5

          8b6a819c6926597dfa7529b692d7a6cc

          SHA1

          50c535e9cca464afd3a589d2231d87ce417d4312

          SHA256

          b9cb5501cc2d257e049e1757062523c7f9ee5a85d57d46538fe492125befd26c

          SHA512

          dfd28b270d99ad89f8ce1df9750b92ff558f73fe2448bf182b5c1c05c7b180bb29175eeaf5a7c918791d64b36167fc1a6044f1aaff838e02e878782f5f6c0ba9

        • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build3.exe

          Filesize

          77KB

          MD5

          91de23a7727e24707ef31505e5406229

          SHA1

          1a0e8b9481e69cc736720ddf888c092364f63526

          SHA256

          3c89aa802e2ea458c588d2c1c7f4c8b5b624d18a374b3f5a84a46550659301bd

          SHA512

          87314985d3ee3a5c4f433b8f90153a193246eb4ca457748e03bb8fb77904d7d3aa7d5e77ad77967d76652592261481eef6dd8c64ba3fecbcf173472a5e6bfbfc

        • C:\Users\Admin\AppData\Local\3488ab4c-3de8-45be-a9b7-1406c15fb4d9\build3.exe

          Filesize

          299KB

          MD5

          41b883a061c95e9b9cb17d4ca50de770

          SHA1

          1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

          SHA256

          fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

          SHA512

          cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          36KB

          MD5

          e074f8da75ef09866529487f5d50c59e

          SHA1

          b01e28313bd9840f7a2ccaf1d0a47c6eea03166b

          SHA256

          2c6ec851fbd8a7f585338fecb64511ac2b1ea44e23041685f6a4842a36a2f664

          SHA512

          754431ff1292e444b17e93d323fe59a44aa2f28065fb4496515babe3344a5d6aba6f78b04ac8413294bc3a8c88f32fec9e43b07ac6f2bb03bbc457957b0f073c

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          42KB

          MD5

          7471fcc591953f745af5feaf8c146cb3

          SHA1

          a638f5a482ccf0360f95a81e203b0033bdef8746

          SHA256

          140c464d8989aeb4dd6eca04a9c2d3b2098a90234afddae55b24e477bf48a83f

          SHA512

          5644104a0f9b3b5f38fb38a436eabcdf96c22665f863155f2e280a781e7c95dbecf2d6aa0a5847c4287634473bf57f7bc673ff66bae1d566137429044bf4d2d5

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          293KB

          MD5

          8caccc4fa4b46aea14789b8c8731efd6

          SHA1

          b7be0236c27062a16dd4001a08ebf25c6984a8da

          SHA256

          43652d84b0d6298f1b35413a2d852478ab98f88b4d2031e3f9037dc3fb647cf7

          SHA512

          5518112caed39e4bb86b14e6a3d7c662a40a4bf2ecfd75690264b35c479528cf550d550fdec090cfc40c01c6e9d04728ea5164764f7c61ed8783d2caa9c7cb1a

        • memory/308-1-0x00000000006F0000-0x0000000000783000-memory.dmp

          Filesize

          588KB

        • memory/308-3-0x0000000002180000-0x000000000229B000-memory.dmp

          Filesize

          1.1MB

        • memory/656-80-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/656-78-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/656-73-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/1084-47-0x0000000000690000-0x0000000000790000-memory.dmp

          Filesize

          1024KB

        • memory/1084-48-0x00000000020C0000-0x000000000210B000-memory.dmp

          Filesize

          300KB

        • memory/1084-69-0x00000000020C0000-0x000000000210B000-memory.dmp

          Filesize

          300KB

        • memory/1152-29-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1152-36-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1152-30-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1152-37-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1152-34-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1152-24-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1152-53-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1152-22-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1152-63-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1152-23-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2068-151-0x0000000000960000-0x0000000000A60000-memory.dmp

          Filesize

          1024KB

        • memory/2244-102-0x0000000000B50000-0x0000000000C50000-memory.dmp

          Filesize

          1024KB

        • memory/3056-121-0x00000000008A0000-0x00000000009A0000-memory.dmp

          Filesize

          1024KB

        • memory/3272-5-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3272-6-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3272-17-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3272-4-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3272-2-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/4752-20-0x0000000000610000-0x00000000006AF000-memory.dmp

          Filesize

          636KB

        • memory/4784-178-0x0000000000820000-0x0000000000920000-memory.dmp

          Filesize

          1024KB

        • memory/4812-46-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4812-66-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4812-51-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4812-52-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4980-76-0x0000000000940000-0x0000000000944000-memory.dmp

          Filesize

          16KB

        • memory/4980-89-0x0000000000990000-0x0000000000A90000-memory.dmp

          Filesize

          1024KB

        • memory/4980-77-0x0000000000990000-0x0000000000A90000-memory.dmp

          Filesize

          1024KB