Overview
overview
10Static
static
77ev3n.exe
windows7-x64
7ev3n.exe
windows10-2004-x64
Annabelle.exe
windows7-x64
Annabelle.exe
windows10-2004-x64
BadRabbit.exe
windows7-x64
BadRabbit.exe
windows10-2004-x64
Birele.exe
windows10-2004-x64
10Cerber 5.exe
windows7-x64
10Cerber 5.exe
windows10-2004-x64
10Darkside.exe
windows7-x64
10Darkside.exe
windows10-2004-x64
10DeriaLock.exe
windows7-x64
7DeriaLock.exe
windows10-2004-x64
7Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 21:34
Behavioral task
behavioral1
Sample
7ev3n.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
7ev3n.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Annabelle.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
Annabelle.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
BadRabbit.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
BadRabbit.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Birele.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Cerber 5.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral9
Sample
Cerber 5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Darkside.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral11
Sample
Darkside.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
DeriaLock.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral13
Sample
DeriaLock.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
DeriaLock.exe
-
Size
484KB
-
MD5
0a7b70efba0aa93d4bc0857b87ac2fcb
-
SHA1
01a6c963b2f5f36ff21a1043587dcf921ae5f5cd
-
SHA256
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
-
SHA512
2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14
-
SSDEEP
6144:lqHKx3YCgy8HmmjJpnVhvLqCO3bLinIz1wASx:lqHoyHNj/nVhvLcyII
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe DeriaLock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe 1788 DeriaLock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1788 DeriaLock.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1788 DeriaLock.exe