Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15-03-2024 02:29
General
-
Target
ca4120301ffc74c815e99aba3ad78655.exe
-
Size
838KB
-
MD5
ca4120301ffc74c815e99aba3ad78655
-
SHA1
fb5f9b45d563d86028259a4a5df45d2d1a991ef7
-
SHA256
45733f732df30c20bdc95a802a30d1c1653661fbe6442c229f4a39cc0465ada4
-
SHA512
281962ebe1e95a9001d6241cfda4b529b3d4204679ba7bc0ca3dcaf36074cd3e2d8e1d9225cb109f03fd0caed10f68592e2aa638c6db7d40bd1d319355751290
-
SSDEEP
12288:nQVHXDy9U1nKUglcTNLL2pgVHEbksRWDST5FZFWbbLnQjXg7RDD1XpSUa2+Isbya:QZzy9+hLLnrifZg8jXCDmUlob9z
Malware Config
Extracted
djvu
http://astdg.top/fhsgtsspen6/get.php
-
extension
.reqg
-
offline_id
ioYmb0jtMMtue7xjmkS3WQWGWLR8FTQhb2giQtt1
-
payload_url
http://securebiz.org/dl/build2.exe
http://astdg.top/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-jTbSQT8ApY Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0324gDrgo
Extracted
mylobot
pqrqtaz.ru:9879
pickcas.ru:6464
quwkbin.ru:3496
rkbupij.ru:6653
pcqmayq.ru:3629
mmuliwe.ru:3541
stoizji.ru:5189
sfdfrhh.ru:3511
ynciazz.ru:4127
mkglhnw.ru:1946
njeeili.ru:9987
dldzeoo.ru:7525
tkbiqjq.ru:5145
uenosbl.ru:2935
faayshc.ru:9865
nttfazc.ru:6761
nfwsyog.ru:7172
uyfusxm.ru:7372
hxkclwx.ru:1294
zgoysam.ru:2338
Signatures
-
Detected Djvu ransomware 21 IoCs
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Mylobot
Botnet which first appeared in 2017 written in C++.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca4120301ffc74c815e99aba3ad78655.exe"C:\Users\Admin\AppData\Local\Temp\ca4120301ffc74c815e99aba3ad78655.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca4120301ffc74c815e99aba3ad78655.exe"C:\Users\Admin\AppData\Local\Temp\ca4120301ffc74c815e99aba3ad78655.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\afe6a77b-d3f1-42e3-91de-7519d3efb631" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\ca4120301ffc74c815e99aba3ad78655.exe"C:\Users\Admin\AppData\Local\Temp\ca4120301ffc74c815e99aba3ad78655.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca4120301ffc74c815e99aba3ad78655.exe"C:\Users\Admin\AppData\Local\Temp\ca4120301ffc74c815e99aba3ad78655.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\7dec8043-e79e-4465-be7a-7aca6bd01aef\build2.exe"C:\Users\Admin\AppData\Local\7dec8043-e79e-4465-be7a-7aca6bd01aef\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\7dec8043-e79e-4465-be7a-7aca6bd01aef\build2.exe"C:\Users\Admin\AppData\Local\7dec8043-e79e-4465-be7a-7aca6bd01aef\build2.exe"6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"7⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\afe6a77b-d3f1-42e3-91de-7519d3efb631\ca4120301ffc74c815e99aba3ad78655.exeC:\Users\Admin\AppData\Local\afe6a77b-d3f1-42e3-91de-7519d3efb631\ca4120301ffc74c815e99aba3ad78655.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\afe6a77b-d3f1-42e3-91de-7519d3efb631\ca4120301ffc74c815e99aba3ad78655.exeC:\Users\Admin\AppData\Local\afe6a77b-d3f1-42e3-91de-7519d3efb631\ca4120301ffc74c815e99aba3ad78655.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d67fa48cf6cf5f1818b732ea24db1d6e
SHA144858909775b98c384307149a53b231f084427f6
SHA2561dd5acc0e95a7e0a6eea0ce7e4ab2665c928db84a241f4006a06791343b84d27
SHA512c89132c4ac4a3e34e37ba33d98347af7c6a0394eceafb043cfd99e5d41d68575287cc537831a3f42924c975f7716aa0c531c6f619fac2df1c17daca658b926a6
-
Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
Filesize
410B
MD5563eeaeda72f1bebe8625e75c113b6a2
SHA1511caeac166b85abe05d11d0ee14ae30d4274c65
SHA2568a498f009e0bb601d30b069e75935de0f39c27339473540d10229ab2171f2a3b
SHA512ad33057436e4041304fcc8573c612671d126d74b954b887b3f2d1617d8595fbc374881ecb19e8eb28aebaed226e3d7a01394d4335a361d5ebfe31ddd2116f039
-
Filesize
392B
MD5a4baa35ad25ad9165bc6eb9921a9b724
SHA1842123e85d8a7ce585af4beff3aa87d9d2f64e75
SHA2563214baba881dcc5a07f55cfe8ab1105fa1581384b9ca89a590ba88b80b4ce52e
SHA512ddfd304c79b73306a015cebf3257646495783bd8f60f35005d578ad29297bcccacc0f1c6e1141241a61a83056bf62f7c5ec994daaddfa32789d3ec7dfffa1dcc
-
Filesize
576KB
MD52e085fcd5f16febf51893d9054b4e565
SHA1a7af6e55904934b7813b1ca03278a6f00f6c9774
SHA2562226caaeaeb0d4c3cbae31480531a200d8119c174bcccdf9fb20d8006abc4298
SHA5127f633cd190286fa183d637572c0eab61a9498323d9f3716e9e0a59d28b7ab9cb83179c894409810b161f73c005d838eecb18d0cd672adaff628f83526cda8d09
-
Filesize
838KB
MD5ca4120301ffc74c815e99aba3ad78655
SHA1fb5f9b45d563d86028259a4a5df45d2d1a991ef7
SHA25645733f732df30c20bdc95a802a30d1c1653661fbe6442c229f4a39cc0465ada4
SHA512281962ebe1e95a9001d6241cfda4b529b3d4204679ba7bc0ca3dcaf36074cd3e2d8e1d9225cb109f03fd0caed10f68592e2aa638c6db7d40bd1d319355751290
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
608KB
-
Filesize
608KB
-
Filesize
1.1MB
-
Filesize
612KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB