Overview
overview
10Static
static
77ev3n.exe
windows7-x64
7ev3n.exe
windows10-2004-x64
Annabelle.exe
windows7-x64
Annabelle.exe
windows10-2004-x64
BadRabbit.exe
windows7-x64
BadRabbit.exe
windows10-2004-x64
Birele.exe
windows10-2004-x64
10Cerber 5.exe
windows7-x64
10Cerber 5.exe
windows10-2004-x64
10Darkside.exe
windows7-x64
10Darkside.exe
windows10-2004-x64
10DeriaLock.exe
windows7-x64
7DeriaLock.exe
windows10-2004-x64
7Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 21:34
Behavioral task
behavioral1
Sample
7ev3n.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7ev3n.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Annabelle.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Annabelle.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
BadRabbit.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
BadRabbit.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Birele.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
Cerber 5.exe
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
Cerber 5.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
Darkside.exe
Resource
win7-20240221-en
Behavioral task
behavioral11
Sample
Darkside.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
DeriaLock.exe
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
DeriaLock.exe
Resource
win10v2004-20240226-en
General
-
Target
Birele.exe
-
Size
116KB
-
MD5
41789c704a0eecfdd0048b4b4193e752
-
SHA1
fb1e8385691fa3293b7cbfb9b2656cf09f20e722
-
SHA256
b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23
-
SHA512
76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea
-
SSDEEP
3072:pYV/aVHN9ySTn34w33FVTyuGAxsvBLSqAKZqoqrxy031l3y:8adNlltyu3Pa5gr33
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Birele.exe" Birele.exe -
resource yara_rule behavioral7/memory/860-0-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral7/memory/860-2-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral7/memory/860-4-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral7/memory/860-5-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral7/memory/860-17-0x0000000000400000-0x0000000000438000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Birele.exe" Birele.exe -
Kills process with taskkill 1 IoCs
pid Process 1828 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1828 taskkill.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 860 wrote to memory of 1828 860 Birele.exe 87 PID 860 wrote to memory of 1828 860 Birele.exe 87 PID 860 wrote to memory of 1828 860 Birele.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Birele.exe"C:\Users\Admin\AppData\Local\Temp\Birele.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1828
-