Overview

overview

10

Static

static

10

00260c390f...f8.exe

windows7-x64

10

00260c390f...f8.exe

windows10-2004-x64

10

01bf78841b...16.exe

windows7-x64

9

01bf78841b...16.exe

windows10-2004-x64

9

0545f842ca...49.exe

windows7-x64

10

0545f842ca...49.exe

windows10-2004-x64

10

068ca3e92c...fd.exe

windows7-x64

10

068ca3e92c...fd.exe

windows10-2004-x64

10

0b856337d9...c9.exe

windows7-x64

10

0b856337d9...c9.exe

windows10-2004-x64

10

0d38f8bf83...09.exe

windows7-x64

10

0d38f8bf83...09.exe

windows10-2004-x64

10

0e35a681fc...5e.exe

windows7-x64

10

0e35a681fc...5e.exe

windows10-2004-x64

10

0f178bc093...35.exe

windows7-x64

10

0f178bc093...35.exe

windows10-2004-x64

10

10306702a1...dd.dll

windows7-x64

10

10306702a1...dd.dll

windows10-2004-x64

10

160c972897...21.exe

windows7-x64

10

160c972897...21.exe

windows10-2004-x64

10

19f7d53c4a...a0.exe

windows7-x64

10

19f7d53c4a...a0.exe

windows10-2004-x64

10

1b109db549...18.exe

windows7-x64

10

1b109db549...18.exe

windows10-2004-x64

10

1e10e08cda...18.dll

windows7-x64

10

1e10e08cda...18.dll

windows10-2004-x64

10

1eb0b48ca7...1d.dll

windows7-x64

1

1eb0b48ca7...1d.dll

windows10-2004-x64

1

1f0e4cbc1a...7d.exe

windows7-x64

10

1f0e4cbc1a...7d.exe

windows10-2004-x64

10

239c9969fd...90.exe

windows7-x64

10

239c9969fd...90.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    18/03/2024, 09:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
  • Size 147KB
  • Sample240318-ky38dadf6s
  • SHA256 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\cHpfiXA9s.README.txt

Ransom Note
  • ~~~ XeqtR Ransomeware The world's fastest ransomware ~~~ >>>> Your data is now stolen and encrypted, pleaes read the following carefully, as it is in your best interest. We are sorry to inform you that a Ransomware Virus has taken control of your computer. ALL of your important files and folders on your computer have been encrypted with a military grade encryption algorithm. Your documents, videos, images and every other forms of data are now inaccessible and completely locked, and cannot be unlocked without the sole decryption key, in which we are the ONLY ones in possession of this key. This key is currently being stored on a remote server. To acquire this key and have all files restored, transfer the amount of 500 USD in the cryptocurrency BITCOIN to the below specified bitcoin wallet address before the time runs out. Once you have read this you now have 36 hours until your files are lost forever. If you fail to take action within this time window, the decryption key will be destroyed and access to your files will be permanently lost. If you are not familiar with cryptocurrency and bitcoin, just do a google search, visit bitcoin.org, go on your mobile to Cash App, or pretty much just ask someone and most likely they can explain it. Once again, 500 USD in the form of Bitcoin to this wallet address bc1q8wqyacjzzvrn57d2g7aj35lnr5r8fqv0dn0394 The second you have sent the bitcoin and the transaction verifies another text file will appear on your desktop with the website to get your key, and the simple instructions on how to use it to get your files back. 36 hours starts now, we suggest you do not waste time. For any reason you should need customer service, email [email protected]

Signatures

  • Renames multiple (9399) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
    "C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\ProgramData\97EC.tmp
      "C:\ProgramData\97EC.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\97EC.tmp >> NUL
        3⤵
          PID:2976
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:1092

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            BBBBBBBBBBB
            • Path C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\BBBBBBBBBBB
            • Size 129B
            • SHA256 d6793498e4a53dbdc73f18aa2561a1a5da3cc47abf55035aa87ce5ad35f8b6fb
            • MD5 SHA1 SHA512
            Submit Download

            cHpfiXA9s.ico
            • Path C:\ProgramData\cHpfiXA9s.ico
            • Size 14KB
            • SHA256 95e059ef72686460884b9aea5c292c22917f75d56fe737d43be440f82034f438
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
            • Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
            • Size 147KB
            • SHA256 49910923f8c6624c6bde580e7c3bab33f419854d89c74fdbf5a850c5bdb55a05
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cHpfiXA9s.README.txt
            • Path C:\cHpfiXA9s.README.txt
            • Size 1KB
            • SHA256 0ec8c3830d53015c531dd0d8c540bc961f67888bb44731f87af6ba8be1268df3
            • MD5 SHA1 SHA512
            Submit Download

            DDDDDDDDDDD
            • Path F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\DDDDDDDDDDD
            • Size 129B
            • SHA256 2b923950e683d3c8623264f1ee9d06602f90920e04a5d7d0f52ec67d20f68f40
            • MD5 SHA1 SHA512
            Submit Download

            97EC.tmp
            • Path \ProgramData\97EC.tmp
            • Size 14KB
            • SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1572-13730-0x000000007EFA0000-0x000000007EFA1000-memory.dmp
            Download

            memory/1572-13731-0x0000000002180000-0x00000000021C0000-memory.dmp
            Download

            memory/1572-13734-0x0000000002180000-0x00000000021C0000-memory.dmp
            Download

            memory/1572-13737-0x000000007EF80000-0x000000007EF81000-memory.dmp
            Download

            memory/1572-13739-0x000000007EF20000-0x000000007EF21000-memory.dmp
            Download

            memory/1572-13763-0x000000007EF40000-0x000000007EF41000-memory.dmp
            Download

            memory/1572-13764-0x000000007EF60000-0x000000007EF61000-memory.dmp
            Download

            memory/2408-0-0x0000000000250000-0x0000000000290000-memory.dmp
            Download