Overview

overview

10

Static

static

10

00260c390f...f8.exe

windows7-x64

10

00260c390f...f8.exe

windows10-2004-x64

10

01bf78841b...16.exe

windows7-x64

9

01bf78841b...16.exe

windows10-2004-x64

9

0545f842ca...49.exe

windows7-x64

10

0545f842ca...49.exe

windows10-2004-x64

10

068ca3e92c...fd.exe

windows7-x64

10

068ca3e92c...fd.exe

windows10-2004-x64

10

0b856337d9...c9.exe

windows7-x64

10

0b856337d9...c9.exe

windows10-2004-x64

10

0d38f8bf83...09.exe

windows7-x64

10

0d38f8bf83...09.exe

windows10-2004-x64

10

0e35a681fc...5e.exe

windows7-x64

10

0e35a681fc...5e.exe

windows10-2004-x64

10

0f178bc093...35.exe

windows7-x64

10

0f178bc093...35.exe

windows10-2004-x64

10

10306702a1...dd.dll

windows7-x64

10

10306702a1...dd.dll

windows10-2004-x64

10

160c972897...21.exe

windows7-x64

10

160c972897...21.exe

windows10-2004-x64

10

19f7d53c4a...a0.exe

windows7-x64

10

19f7d53c4a...a0.exe

windows10-2004-x64

10

1b109db549...18.exe

windows7-x64

10

1b109db549...18.exe

windows10-2004-x64

10

1e10e08cda...18.dll

windows7-x64

10

1e10e08cda...18.dll

windows10-2004-x64

10

1eb0b48ca7...1d.dll

windows7-x64

1

1eb0b48ca7...1d.dll

windows10-2004-x64

1

1f0e4cbc1a...7d.exe

windows7-x64

10

1f0e4cbc1a...7d.exe

windows10-2004-x64

10

239c9969fd...90.exe

windows7-x64

10

239c9969fd...90.exe

windows10-2004-x64

10

Resubmissions

20-03-2024 09:55

240320-lxzn8sdh94 10

20-03-2024 09:53

240320-lwzb3sef3x 10

18-03-2024 09:01

240318-ky38dadf6s 10

Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    18-03-2024 09:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

  • Size

    147KB

  • MD5

    75256873a03f4a4bc073185f48c1097c

  • SHA1

    e9023061def67ba21c09826fadc1607fd7f71d88

  • SHA256

    068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd

  • SHA512

    4b718093ad42d7b7b72498dfcbcfd1b39c980ef44e999b7035e6bfe6b782aad6b7553832f1efee45003d9b0c56bf2e408ca55082c550ac4faa19f199f366dede

  • SSDEEP

    3072:s6glyuxE4GsUPnliByocWepvdHFdjFpZ/fgyVF0dj:s6gDBGpvEByocWetdHZ/fgKF0

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\cHpfiXA9s.README.txt

Ransom Note
~~~ XeqtR Ransomeware The world's fastest ransomware ~~~ >>>> Your data is now stolen and encrypted, pleaes read the following carefully, as it is in your best interest. We are sorry to inform you that a Ransomware Virus has taken control of your computer. ALL of your important files and folders on your computer have been encrypted with a military grade encryption algorithm. Your documents, videos, images and every other forms of data are now inaccessible and completely locked, and cannot be unlocked without the sole decryption key, in which we are the ONLY ones in possession of this key. This key is currently being stored on a remote server. To acquire this key and have all files restored, transfer the amount of 500 USD in the cryptocurrency BITCOIN to the below specified bitcoin wallet address before the time runs out. Once you have read this you now have 36 hours until your files are lost forever. If you fail to take action within this time window, the decryption key will be destroyed and access to your files will be permanently lost. If you are not familiar with cryptocurrency and bitcoin, just do a google search, visit bitcoin.org, go on your mobile to Cash App, or pretty much just ask someone and most likely they can explain it. Once again, 500 USD in the form of Bitcoin to this wallet address bc1q8wqyacjzzvrn57d2g7aj35lnr5r8fqv0dn0394 The second you have sent the bitcoin and the transaction verifies another text file will appear on your desktop with the website to get your key, and the simple instructions on how to use it to get your files back. 36 hours starts now, we suggest you do not waste time. For any reason you should need customer service, email [email protected]

Signatures

  • Renames multiple (9399) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
    "C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\ProgramData\97EC.tmp
      "C:\ProgramData\97EC.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\97EC.tmp >> NUL
        3⤵
          PID:2976
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:1092

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\BBBBBBBBBBB
        Filesize

        129B

        MD5

        2657a0e864c9edd2ac4512b622bc502b

        SHA1

        1b4d1cf16d991bcb714fae039ea28271750becc3

        SHA256

        d6793498e4a53dbdc73f18aa2561a1a5da3cc47abf55035aa87ce5ad35f8b6fb

        SHA512

        0fbd59fdcaa6c95e76637659e5826c39abc2f3900c70bc614738e34e156dcb87df9766ea570d238f6b84503b4998b07ddaae3d70bc2040d18dab9b3ab8bc4416

        Download Submit

      • C:\ProgramData\cHpfiXA9s.ico
        Filesize

        14KB

        MD5

        88d9337c4c9cfe2d9aff8a2c718ec76b

        SHA1

        ce9f87183a1148816a1f777ba60a08ef5ca0d203

        SHA256

        95e059ef72686460884b9aea5c292c22917f75d56fe737d43be440f82034f438

        SHA512

        abafea8ca4e85f47befb5aa3efee9eee699ea87786faff39ee712ae498438d19a06bb31289643b620cb8203555ea4e2b546ef2f10d3f0087733bc0ceaccbeafd

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        c76cb382b5078d0ff97f5c0955833cec

        SHA1

        0a4f596e3325d9267048465ad325ebcafecb77ad

        SHA256

        49910923f8c6624c6bde580e7c3bab33f419854d89c74fdbf5a850c5bdb55a05

        SHA512

        77280ae9ecbd4d4e86906a50eaea5f4e9b0f55412a66f5fbdbf7aa734982567d603c75f25549d475cea0d6e9186e9a2406f25f0802c4107a5f90c19080224b29

        Download Submit

      • C:\cHpfiXA9s.README.txt
        Filesize

        1KB

        MD5

        3605fdc69caa6b331eaf96ea07e4157d

        SHA1

        fc6bce8fc36aa774fb5e02cc1b25df8b59c6fa44

        SHA256

        0ec8c3830d53015c531dd0d8c540bc961f67888bb44731f87af6ba8be1268df3

        SHA512

        8b3eddd76b231bf1cca7e26d83756d418fab432afb6c7fc46e3e1356c8a580b78e09f29ef3adbadf72a8258c29d4855dac9b4b5c4519535b93a982469519c226

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        879afa37331cf3bbcbca5078e88c4794

        SHA1

        68c9ef96386ae06272cc0514d4893b32bf8bb540

        SHA256

        2b923950e683d3c8623264f1ee9d06602f90920e04a5d7d0f52ec67d20f68f40

        SHA512

        6044b84c30b8d6ef313bcbb0f094942f1999c255bd97c3adca66deeee1d7be5102e807a280ca0edc4f1d8d1c067c6ee507858e2d14d096b58dcef7212cc40d08

        Download Submit

      • \ProgramData\97EC.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/1572-13730-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1572-13731-0x0000000002180000-0x00000000021C0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1572-13734-0x0000000002180000-0x00000000021C0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1572-13737-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1572-13739-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1572-13763-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1572-13764-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2408-0-0x0000000000250000-0x0000000000290000-memory.dmp

        Filesize

        256KB

        Download