441116d55e97124a067207bf57483dd3462bccfb034e56c4152675b0dcb118e7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bit Paymer.exe
Size

92KB
MD5

998246bd0e51f9582b998ca514317c33
SHA1

5a2d799ac4cca8954fc117c7fb3e868f93c6f009
SHA256

d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2
SHA512

773d9838be9c09bd43a22aa1eada8f623f95739b21828712236a4a209c6d9266647ef43592d072d68399224965253c37f9ce9ef36e46e8191169c03ac7789130
SSDEEP

1536:tacFdjxs2TlWlpnXv91nhixG8/lA5jG8387SpK6jXOMVHoi5e+vRb:taqJC6lWlpnXv7nhixhlAU83VwMCifvR

Score

10^/10

persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.readme_txt

Ransom Note

YOUR COMPANY HAS BEEN SUCCESSFULLY PENETRATED! All files are encrypted. We accept only bitcoins to share the decryption software for your network. Also, we have gathered all your private sensitive data.So if you decide not to pay anytime soon, we would share it with media's. It may harm your business reputation and the company's capitalization fell sharply. Do not try to do it with 3rd-parties programs, files might be damaged then. Decrypting of your files is only possible with the special decryption software. To receive your private key and the decryption software please follow the link (using tor2web service): https://qmnmrba4s4a3py6z.onion.to/order/43e4593a-5dc7-11e7-8803-00163e417ea3 If this address is not available, follow these steps: 1. Download and install Tor Browser: https://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: http://qmnmrba4s4a3py6z.onion/order/43e4593a-5dc7-11e7-8803-00163e417ea3 4. Follow the instructions on the site 5. This link is valid for 72 hours only. Afetr that period your local data would be lost completely. 6. Any questions: [email protected]

Emails

[email protected]

URLs

https://qmnmrba4s4a3py6z.onion.to/order/43e4593a-5dc7-11e7-8803-00163e417ea3

http://qmnmrba4s4a3py6z.onion/order/43e4593a-5dc7-11e7-8803-00163e417ea3

Signatures

Renames multiple (9901) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 3 IoCs

pid	Process
2644	etr:exe
2680	bet3jB.exe
2592	oXRp:exe

Loads dropped DLL 6 IoCs

pid	Process
2700	Bit Paymer.exe
2700	Bit Paymer.exe
2624	cmd.exe
2624	cmd.exe
2680	bet3jB.exe
2680	bet3jB.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\zOmnWxmvBWc = "C:\\Users\\Admin\\AppData\\Local\\TEaM\\YuC.exe"	Bit Paymer.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	oXRp:exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur	oXRp:exe
File opened for modification	C:\Program Files\Windows Journal\MSPVWCTL.DLL	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL.readme_txt	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN075.XML.locked	oXRp:exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.locked	oXRp:exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Cayman.locked	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02093_.WMF.locked	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\ACEDAO.DLL.locked	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_COL.HXT.readme_txt	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTBOX.JPG.readme_txt	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00396_.WMF.readme_txt	oXRp:exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\init.js	oXRp:exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.readme_txt	oXRp:exe
File opened for modification	C:\Program Files\Java\jre7\bin\instrument.dll	oXRp:exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	oXRp:exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf.locked	oXRp:exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_sr.dll	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00058_.WMF	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02009_.WMF.readme_txt	oXRp:exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.readme_txt	oXRp:exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\ICE.INF.locked	oXRp:exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\PREVIEW.GIF.readme_txt	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.locked	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107282.WMF	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382950.JPG.locked	oXRp:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml	oXRp:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF.readme_txt	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Priority.accft	oXRp:exe
File opened for modification	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll	oXRp:exe
File created	C:\Program Files\Java\jre7\lib\logging.properties.locked	oXRp:exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api.readme_txt	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.readme_txt	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18190_.WMF.locked	oXRp:exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\settings.css	oXRp:exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Efate.readme_txt	oXRp:exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.readme_txt	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107024.WMF	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\PASSWORD.JPG.locked	oXRp:exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.locked	oXRp:exe
File opened for modification	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.locked	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL.locked	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_COL.HXT.readme_txt	oXRp:exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.locked	oXRp:exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo	oXRp:exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\THMBNAIL.PNG	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00527_.WMF	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\REVERSE.DLL.locked	oXRp:exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.DLL.locked	oXRp:exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msaddsr.dll.mui	oXRp:exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.locked	oXRp:exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.locked	oXRp:exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.readme_txt	oXRp:exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.locked	oXRp:exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.readme_txt	oXRp:exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	oXRp:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187895.WMF.readme_txt	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR29B.GIF	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF.locked	oXRp:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBRV.XML	oXRp:exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9.readme_txt	oXRp:exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.readme_txt	oXRp:exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.readme_txt	oXRp:exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis	oXRp:exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
2312	net.exe
2452	net.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\etr:exe	Bit Paymer.exe
File created	C:\Users\Admin\AppData\Local\oXRp:exe	bet3jB.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2624	2700	Bit Paymer.exe	29
PID 2700 wrote to memory of 2624	2700	Bit Paymer.exe	29
PID 2700 wrote to memory of 2624	2700	Bit Paymer.exe	29
PID 2700 wrote to memory of 2624	2700	Bit Paymer.exe	29
PID 2700 wrote to memory of 2644	2700	Bit Paymer.exe	31
PID 2700 wrote to memory of 2644	2700	Bit Paymer.exe	31
PID 2700 wrote to memory of 2644	2700	Bit Paymer.exe	31
PID 2700 wrote to memory of 2644	2700	Bit Paymer.exe	31
PID 2624 wrote to memory of 2680	2624	cmd.exe	33
PID 2624 wrote to memory of 2680	2624	cmd.exe	33
PID 2624 wrote to memory of 2680	2624	cmd.exe	33
PID 2624 wrote to memory of 2680	2624	cmd.exe	33
PID 2680 wrote to memory of 2592	2680	bet3jB.exe	34
PID 2680 wrote to memory of 2592	2680	bet3jB.exe	34
PID 2680 wrote to memory of 2592	2680	bet3jB.exe	34
PID 2680 wrote to memory of 2592	2680	bet3jB.exe	34
PID 2644 wrote to memory of 2312	2644	etr:exe	36
PID 2644 wrote to memory of 2312	2644	etr:exe	36
PID 2644 wrote to memory of 2312	2644	etr:exe	36
PID 2644 wrote to memory of 2312	2644	etr:exe	36
PID 2644 wrote to memory of 2452	2644	etr:exe	38
PID 2644 wrote to memory of 2452	2644	etr:exe	38
PID 2644 wrote to memory of 2452	2644	etr:exe	38
PID 2644 wrote to memory of 2452	2644	etr:exe	38

C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe
"C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\65A\bet3jB.exe 2
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\65A\bet3jB.exe
    C:\Users\Admin\AppData\Local\65A\bet3jB.exe 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - NTFS ADS
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\oXRp:exe
      C:\Users\Admin\AppData\Local\oXRp:exe 3 C:\Users\Admin\AppData\Local\65A\bet3jB.exe
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      PID:2592
- C:\Users\Admin\AppData\Local\etr:exe
  C:\Users\Admin\AppData\Local\etr:exe 1 C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\net.exe
    C:\Windows\system32\net.exe view
    3⤵
    - Discovers systems in the same network
    PID:2312
- - C:\Windows\SysWOW64\net.exe
    C:\Windows\system32\net.exe view \\GHPZRGFC
    3⤵
    - Discovers systems in the same network
    PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db

Filesize
16KB

MD5
fba18653631301ca0726646883ba0434

SHA1
489b55b760828e08696e80229996c98a69b582c0

SHA256
d180bbc6ec2c6a63f46585622cd52a743d7a06b3b88375ef5d6e16805b383ddf

SHA512
476e7053788a82a38ab19dfc1c3b8a29c34ab08a1fb8cce1e57832e541090a3066632a92a5066daafb3bc442c8a7836bb54f991657171e4229ecbbd5ee48e58e

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{6F844591-3C00-48EE-AB0B-12F481DA4D03}.2.ver0x0000000000000001.db

Filesize
2KB

MD5
fb4ad80f2dba87aa120fb72fe627c17f

SHA1
b47ec9c0c29f7acaedd38c5d722e3aafd2ef7fbd

SHA256
91d45976792fdec43805b98597ea2ac4fa34d97abce390b877d90cd894d76207

SHA512
f0f0ca0f6b67744e29bd5090f151277d520c6039973a94250b8afa8dd6b6dc3bbc906a067fb3bbbdff085f20b4d7d67eefa0750b4919bdadd6e2d10144bbd89d

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{B3505F7D-EC38-493E-A7F2-F8A0F174AEB3}.2.ver0x0000000000000002.db

Filesize
1KB

MD5
2ab8b431e76779c441945eb2fe96dede

SHA1
f268ed1315224962abd8bf4be89f8f7da7ad9fbe

SHA256
e4161ff6f1bc485840e737e07e734024f22dbd4c52bf5dafbba47ffd7ec4dbf3

SHA512
15203b691fd3ce300246d0f7e5ca83598b1f9fe7a6055f9fae8c89fb5a1a68e2814f5cce9490dbda110d758a00c917b2ec0f343ac6394b247cfbf3928098c9f2

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db

Filesize
405KB

MD5
9641bc98d0335bff9a2ce20bb3cd3d4a

SHA1
be4bdff3a5ee4588bf7d88ffd318091c957c8dc7

SHA256
00cfafcc42a97025ac850dcd1a656fad7e095d53818157d7f9c7f8014717dff4

SHA512
2d9dfb40d55a87bf642e540eb169efe3faab84ecc7f84ab54bb80e771d3ff9aff7309baa13781fa910d9109548adc0f27d05c33fb08c301711e34a5ed9b3f29b

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{E48F83B9-4BC6-426E-947C-5087031BE245}.2.ver0x0000000000000002.db

Filesize
1KB

MD5
b5e0d8065f9b7166ade7cb5b61535c59

SHA1
04d2c1052c7050d55c20626cd7cf2d54d1897a36

SHA256
d48bd31efa98ad9c9a4fa4876dd2e004bf0de361dc5e63f0bf5db416faad353c

SHA512
29670e428aa54e5104d272aae43ebbdd131494c1a71b27d7e85c507b88b39e966967f30cf7b5d2a846cb92be164b1dcf97d5a86d2539939ed0d65029a65637ed

Download Submit
C:\Users\Admin\AppData\Local\65A\bet3jB.exe

Filesize
92KB

MD5
998246bd0e51f9582b998ca514317c33

SHA1
5a2d799ac4cca8954fc117c7fb3e868f93c6f009

SHA256
d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2

SHA512
773d9838be9c09bd43a22aa1eada8f623f95739b21828712236a4a209c6d9266647ef43592d072d68399224965253c37f9ce9ef36e46e8191169c03ac7789130

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

Filesize
4B

MD5
76390d3429ba451f1e37daae6bc85b51

SHA1
c8e633f4a5ad8991f348fa8bf85dfec134e2c4dc

SHA256
31d694956ddcdb8b2d61ee7b91beb5af37ce0557b6ca44438d2c3ca9f96c56d9

SHA512
cff8a95d7efbabc3ac3c06b721166ac26254eadcbed6296bb17712be07c1b7245ab22fb9b558371b0a69e855451706180ef20ccb57f639cbe818c14d90bd3e54

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.readme_txt

Filesize
1KB

MD5
51fab08a170e3c398e696a5d36cde259

SHA1
b60d83b9db3831998bb5672e4a4a1610cf4e1cb1

SHA256
bab1199a9b43d11429c79f0b15c7e8c8d61ec612aca223aa66fd253eab11f1cb

SHA512
50b95e5bd31ab894e997773c374592bda8a0cf44f92c9b92aad8155928240c1a2d177f81bcdefe72d686413dd9494f8010f66f9e191b7a549fb99902c6f2c3d6

Download Submit
memory/2592-9705-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2592-25640-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2644-9650-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2644-22-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2680-30-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2700-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2700-15-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2700-0-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads