Analysis

  • max time kernel
    299s
  • max time network
    189s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-02-2024 05:02

General

  • Target

    fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe

  • Size

    824KB

  • MD5

    f2676ea250de972076b79913ffa7fbb8

  • SHA1

    5b6b1b7e54736260173f6e8b44f33bcc8260b6e2

  • SHA256

    fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22

  • SHA512

    f2f2a6eec3139c233378fb8888edbe5c8bdd76869a3e3e10d1275a7fcc2e43667ea5031a6db629556d4d92d9d188dc3acd772fe3709ff664efc66deb196881d9

  • SSDEEP

    12288:csaCCG1t2SJ0uT2gszaWjkCI+e9KVmkcU/09xM19+uE+3jf3wptt0ws:Z1vqRaWgC69jkt0LzuvjotSw

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdcc

  • offline_id

    LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

C2

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110

Attributes
  • profile_id_v2

    1b9d7ec5a25ab9d78c31777a0016a097

Signatures

  • Detect Vidar Stealer 7 IoCs
  • Detected Djvu ransomware 17 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe
    "C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe
      "C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\7423993d-4b42-4983-8146-cd933babd6c2" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:3556
      • C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe
        "C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4028
        • C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe
          "C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe
            "C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4196
          • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe
            "C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4968
            • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe
              "C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4136
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                7⤵
                • Creates scheduled task(s)
                PID:1124
  • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe
    "C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe"
    1⤵
    • Executes dropped EXE
    PID:3536
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 2108
      2⤵
      • Program crash
      PID:4144
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        3⤵
        • Creates scheduled task(s)
        PID:696
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:756
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:2592
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:1580
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4188
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:4152
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4176
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:2824
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4148

Network

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
    Filesize

    1KB

    MD5

    8112ab2a9d7578692e66734917d00015

    SHA1

    5dc1f7cb2c66c925d195fb98784917d108a001dd

    SHA256

    919561b1927726f5218e79f21184c4bf7117db4466686fc93d3d5dbc1380033b

    SHA512

    538f1f36b44d628d2ade163cc40deb58b50cb7fbd56019d9526c8233c30771db8542ed5786d311322dfd2e9d44e979da9513c4a0bbc7416b47bb7beca90013d1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
    Filesize

    724B

    MD5

    8202a1cd02e7d69597995cabbe881a12

    SHA1

    8858d9d934b7aa9330ee73de6c476acf19929ff6

    SHA256

    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

    SHA512

    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
    Filesize

    410B

    MD5

    45d59644251cc6534ea8a5f9fe4098fe

    SHA1

    7dc4ba5b282869052655d3eeb3c6b4ce7de9c25b

    SHA256

    6bd6dd2ce9fe871db728ec6a906d113c641bb213acd13a49ccd3fef71bc6e463

    SHA512

    cd4aa57ff59c463239c2f5b9a511eb709ad8b9afe3082d74ae512c09768f4bab57c0bb943cb1e4ec861d950f4c1d3cf2e1b89455ebf332f977cf30de62675b7e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
    Filesize

    392B

    MD5

    5111c39ff862d5a31675e0d4f8c9de31

    SHA1

    385d1697e5391dae7a3cf78b5fe4c304102cde69

    SHA256

    d2f0e168a364b595b4cd4c9c3ff6d15e28895f2f2996329541b4c9f8ef5b8441

    SHA512

    4117b957786148160c77b347fe784f9002df5b72b1a8e48abc90150555b5278abc132e3dfc37a9be0ffed92ffb24900fea2126d148f78c7005b6fcb2425e78d4

  • C:\Users\Admin\AppData\Local\7423993d-4b42-4983-8146-cd933babd6c2\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe
    Filesize

    99KB

    MD5

    cd85105d143997c993bb8f4e363b1a90

    SHA1

    c140f42246719638ed7a76f11c1b4dd70603528c

    SHA256

    9505946110cd8b06a8f57f03fee5a4cac8f4060c63dae0a9035fb67add2e3a8d

    SHA512

    3eee4c2f3b318fcae11de50183ffc1f3f146bef5a55bf90c47517967ab34a3795269b75cbafb74d4d1c02eeab1292ddcf6e74752befa690ba134df9091ddf138

  • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe
    Filesize

    100KB

    MD5

    d08ef828c7b6ae0fea84b4d852ec1b16

    SHA1

    d1a7b25bdce03156afe5bdfb9124fe2c5058ec84

    SHA256

    08698f08a85a2ef5071c6ed7be6140ade7a1813639baebddb7909dbba5a36b39

    SHA512

    1cd2f38c569cdbdfa2e2cd78fe37a54125106a54430c08315ddc812460ee371d390c7aaa61d3966da2662ca54ddbf4030af1cb29ebd7e9fb8962d81df1c94dcf

  • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe
    Filesize

    92KB

    MD5

    1f32a439bc028b0047e09221ba7def73

    SHA1

    a574b924dfe7565555edc2b8b6d85c235b683907

    SHA256

    e60a315082a2218597831b04992958d8bbf7bcfb2ed5f259a05087f6b857f57b

    SHA512

    378e5904d83cbdc95d5ef4099221435fe4aa5f531588b5daccb6c417f543b2134865763a3a2acd7d2b5a3ab7ae8c4e9fb326a4df15d3b6d3c6d5e317235b9f52

  • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe
    Filesize

    112KB

    MD5

    c6865862dae23d20114b7829b3f32bad

    SHA1

    52f35a35a9c952cb08e8963216b536f19587b7ae

    SHA256

    af1c72ac9d010bac9d9e25b1f63c5a441d3e85128c66d8e39c8446753b6c30aa

    SHA512

    d7f84fcd1273ca6f5dcbf1d7028cc64b8bfd835008a856fbcd8fd713da943989803019d288e68f97654391283831cec5c4749c09aae780d2da53f8349717a28d

  • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe
    Filesize

    27KB

    MD5

    c7b438b4b2aaa93242a3fcb32a4f2902

    SHA1

    1005b3d719cacaf36bcf7d10877dd257d5fe11f1

    SHA256

    c4ef51333f1cae7f0d7c2900a8e7b1d7a3df889a8b1f71435a71218392117c46

    SHA512

    527c3e0189a361eda758eb26bce7e93450914debb1784f261daf49953925d96a4bfc80f0ec5d2ed3ee5265a7663036dfc67ae9df15ab5e08d9feb583351c9d97

  • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe
    Filesize

    1KB

    MD5

    d35c806c95b926208b06f305860de044

    SHA1

    fd111b2072749c0e2b3f1bb7102e4fbcdd8b931b

    SHA256

    722325dfc7e0a3d8b9c5bcf978e54f9a90a83ffa5d14372a51dc7c3609fee061

    SHA512

    cb5f66f83bd6a8ddad6d740479d17352d3a8249ab6fec7ea0ee071dcc7f9855ed378dee61bb65e92d272e3fb8187282ce08d0694550cfa610bf6e6508ec5b6a6

  • C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe
    Filesize

    96KB

    MD5

    a10047b22a7ff0ddc36a2ba752ed6a59

    SHA1

    8f1136a7ce46220e1205d36c692f6d482a40e716

    SHA256

    d86fb0e11d51ac8a5f6b40c075136569725e7b98decae9f7a88597c0f474db9b

    SHA512

    951dc2f074e54797cfbf5cadbd637456bf464828816bf42966d67aada836e3325a009e5808256260528b6ce6529c99e5ee22af5d820730dae5b894d047d67dcd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    Filesize

    245KB

    MD5

    6ac935d668fd466875bf1c0737e6d2a9

    SHA1

    a6081ccb7b796df29f6151a9dd5026137df2c105

    SHA256

    8bd7937429196d4134337f09dc3973e4fceccc901dc6711246b4450182141af6

    SHA512

    10d6e21e59d7a1781ea038629b6fc9f6b52ad5a542f1fa7fcca767e13796498ba96d8456a959ce9832b2cfc00bbf86b0be0840abcf959e20cdd6cd67901cf90d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    Filesize

    299KB

    MD5

    41b883a061c95e9b9cb17d4ca50de770

    SHA1

    1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

    SHA256

    fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

    SHA512

    cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

  • memory/756-139-0x0000000000A70000-0x0000000000B70000-memory.dmp
    Filesize

    1024KB

  • memory/756-130-0x0000000000A70000-0x0000000000B70000-memory.dmp
    Filesize

    1024KB

  • memory/864-1-0x0000000002130000-0x00000000021D0000-memory.dmp
    Filesize

    640KB

  • memory/864-2-0x0000000002330000-0x000000000244B000-memory.dmp
    Filesize

    1.1MB

  • memory/1580-155-0x0000000000A70000-0x0000000000B70000-memory.dmp
    Filesize

    1024KB

  • memory/1696-6-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/1696-4-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/1696-5-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/1696-3-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/1696-17-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/2592-129-0x0000000000410000-0x00000000004D5000-memory.dmp
    Filesize

    788KB

  • memory/2800-98-0x00000000008A0000-0x00000000009A0000-memory.dmp
    Filesize

    1024KB

  • memory/2824-207-0x00000000008E0000-0x00000000009E0000-memory.dmp
    Filesize

    1024KB

  • memory/3536-52-0x0000000000400000-0x0000000000643000-memory.dmp
    Filesize

    2.3MB

  • memory/3536-53-0x0000000000400000-0x0000000000643000-memory.dmp
    Filesize

    2.3MB

  • memory/3536-48-0x0000000000400000-0x0000000000643000-memory.dmp
    Filesize

    2.3MB

  • memory/3536-86-0x0000000000400000-0x0000000000643000-memory.dmp
    Filesize

    2.3MB

  • memory/4028-21-0x00000000020F0000-0x0000000002183000-memory.dmp
    Filesize

    588KB

  • memory/4136-75-0x0000000000400000-0x0000000000406000-memory.dmp
    Filesize

    24KB

  • memory/4136-83-0x0000000000400000-0x0000000000406000-memory.dmp
    Filesize

    24KB

  • memory/4136-81-0x0000000000400000-0x0000000000406000-memory.dmp
    Filesize

    24KB

  • memory/4152-182-0x00000000008C0000-0x00000000009C0000-memory.dmp
    Filesize

    1024KB

  • memory/4196-47-0x00000000007E0000-0x00000000008E0000-memory.dmp
    Filesize

    1024KB

  • memory/4196-49-0x00000000005F0000-0x0000000000620000-memory.dmp
    Filesize

    192KB

  • memory/4356-30-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4356-36-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4356-37-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4356-34-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4356-29-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4356-22-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4356-24-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4356-23-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4356-45-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4356-70-0x0000000000400000-0x0000000000537000-memory.dmp
    Filesize

    1.2MB

  • memory/4968-80-0x0000000000920000-0x0000000000924000-memory.dmp
    Filesize

    16KB

  • memory/4968-79-0x0000000000B20000-0x0000000000C20000-memory.dmp
    Filesize

    1024KB