djvu | 6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531

General

Target

6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
Size

785KB
MD5

a12e55075d81449f86b1ffb157c11024
SHA1

0eb60fb510d7bdc36ed0775afc5b69dd9d24764c
SHA256

6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531
SHA512

3a501b37e70e6e8b40f481c88aee3b39f9d9fc065650d4ef6832a765287bc5db7ca0ac2489637309eceeb8c4bf2bfea60824b88be876285b65a7d3faa0167dd2
SSDEEP

24576:RM2+t/7EhurayB//FaZf4xq/WzoDe5AjDf:RX+tRrzzEQ6De54D

Score

10^/10

djvu vidar 5739ef2bbcd39fcd59c5746bfe4238c5 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes

extension
.vook
offline_id
1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1
payload_url
http://sdfjhuz.com/dl/build2.exe
http://sajdfue.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

Version

8.6

Botnet

5739ef2bbcd39fcd59c5746bfe4238c5

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

profile_id_v2
5739ef2bbcd39fcd59c5746bfe4238c5
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/3180-48-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/3892-50-0x00000000006C0000-0x00000000006F1000-memory.dmp	family_vidar_v7
behavioral1/memory/3180-52-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/3180-53-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/3180-71-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 16 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3696-2-0x00000000029F0000-0x0000000002B0B000-memory.dmp	family_djvu
behavioral1/memory/2732-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2732-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2732-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2732-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2732-15-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-20-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-21-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-28-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-32-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-38-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-69-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3120-85-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe

Executes dropped EXE 8 IoCs

Processes:

build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exe

pid process

3892 build2.exe
3180 build2.exe
3896 build3.exe
2996 build3.exe
1884 mstsca.exe
3748 mstsca.exe
4776 mstsca.exe
2352 mstsca.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2276 icacls.exe

pid	process
3892	build2.exe
3180	build2.exe
3896	build3.exe
2996	build3.exe
1884	mstsca.exe
3748	mstsca.exe
4776	mstsca.exe
2352	mstsca.exe

pid	process
2276	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f65150aa-3548-419a-8cad-0bbc4dd9089d\\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe\" --AutoStart"	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 api.2ip.ua
8 api.2ip.ua
18 api.2ip.ua

flow	ioc
7	api.2ip.ua
8	api.2ip.ua
18	api.2ip.ua

Suspicious use of SetThreadContext 6 IoCs

Processes:

6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exebuild2.exebuild3.exemstsca.exemstsca.exe

description	pid	process	target process
PID 3696 set thread context of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 set thread context of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3892 set thread context of 3180	3892	build2.exe	build2.exe
PID 3896 set thread context of 2996	3896	build3.exe	build3.exe
PID 1884 set thread context of 3748	1884	mstsca.exe	mstsca.exe
PID 4776 set thread context of 2352	4776	mstsca.exe	mstsca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3884 3180 WerFault.exe build2.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

228 schtasks.exe
4580 schtasks.exe

pid	pid_target	process	target process
3884	3180	WerFault.exe	build2.exe

pid	process
228	schtasks.exe
4580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe

pid	process
2732	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
2732	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
3120	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
3120	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exe

description	pid	process	target process
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3696 wrote to memory of 2732	3696	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 2732 wrote to memory of 2276	2732	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	icacls.exe
PID 2732 wrote to memory of 2276	2732	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	icacls.exe
PID 2732 wrote to memory of 2276	2732	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	icacls.exe
PID 2732 wrote to memory of 4316	2732	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 2732 wrote to memory of 4316	2732	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 2732 wrote to memory of 4316	2732	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 4316 wrote to memory of 3120	4316	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
PID 3120 wrote to memory of 3892	3120	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	build2.exe
PID 3120 wrote to memory of 3892	3120	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	build2.exe
PID 3120 wrote to memory of 3892	3120	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3892 wrote to memory of 3180	3892	build2.exe	build2.exe
PID 3120 wrote to memory of 3896	3120	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	build3.exe
PID 3120 wrote to memory of 3896	3120	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	build3.exe
PID 3120 wrote to memory of 3896	3120	6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe	build3.exe
PID 3896 wrote to memory of 2996	3896	build3.exe	build3.exe
PID 3896 wrote to memory of 2996	3896	build3.exe	build3.exe
PID 3896 wrote to memory of 2996	3896	build3.exe	build3.exe
PID 3896 wrote to memory of 2996	3896	build3.exe	build3.exe
PID 3896 wrote to memory of 2996	3896	build3.exe	build3.exe
PID 3896 wrote to memory of 2996	3896	build3.exe	build3.exe
PID 3896 wrote to memory of 2996	3896	build3.exe	build3.exe
PID 3896 wrote to memory of 2996	3896	build3.exe	build3.exe
PID 3896 wrote to memory of 2996	3896	build3.exe	build3.exe
PID 2996 wrote to memory of 4580	2996	build3.exe	schtasks.exe
PID 2996 wrote to memory of 4580	2996	build3.exe	schtasks.exe
PID 2996 wrote to memory of 4580	2996	build3.exe	schtasks.exe
PID 1884 wrote to memory of 3748	1884	mstsca.exe	mstsca.exe
PID 1884 wrote to memory of 3748	1884	mstsca.exe	mstsca.exe
PID 1884 wrote to memory of 3748	1884	mstsca.exe	mstsca.exe
PID 1884 wrote to memory of 3748	1884	mstsca.exe	mstsca.exe
PID 1884 wrote to memory of 3748	1884	mstsca.exe	mstsca.exe
PID 1884 wrote to memory of 3748	1884	mstsca.exe	mstsca.exe
PID 1884 wrote to memory of 3748	1884	mstsca.exe	mstsca.exe
PID 1884 wrote to memory of 3748	1884	mstsca.exe	mstsca.exe
PID 1884 wrote to memory of 3748	1884	mstsca.exe	mstsca.exe
PID 3748 wrote to memory of 228	3748	mstsca.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
"C:\Users\Admin\AppData\Local\Temp\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3696

C:\Users\Admin\AppData\Local\Temp\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
"C:\Users\Admin\AppData\Local\Temp\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\f65150aa-3548-419a-8cad-0bbc4dd9089d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2276

C:\Users\Admin\AppData\Local\Temp\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
"C:\Users\Admin\AppData\Local\Temp\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4316

C:\Users\Admin\AppData\Local\Temp\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
"C:\Users\Admin\AppData\Local\Temp\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120

C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build2.exe
"C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3892

C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build2.exe
"C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build2.exe"
6⤵
- Executes dropped EXE
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 2056
7⤵
- Program crash
PID:3884

C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build3.exe
"C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3896

C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build3.exe
"C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3180 -ip 3180
1⤵
PID:4464

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1884

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
3⤵
- Creates scheduled task(s)
PID:228

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4776

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:2352

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

1

T1222

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
272ace8675a8e71477748c868fbffd15

SHA1
f34ce658c1f254558cca27671d862d72917c6b4e

SHA256
851558377bda6f453211d71e1e4d7bf9bb81f4f51984ba0653df550a632c3a77

SHA512
475ec315c72cd5d8fe0bd0009b6f9f285ca9be9a915ea2b0203f06d0825d3b278f14565acfb82e7df40d9223386eb097724dc4fe2f516e3fbf787ed7b109c1db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
26da65fe7e17fc3d9eef6dff294535a2

SHA1
2f92d0d5e6eb5a42d3563cd374daab505ad02e17

SHA256
44495dae97ab116dc3c627b3022273fdbdd6c01cc8984b32151b3a0cb2a37cbb

SHA512
c1d2739edd7f718255dc47794eb80058c58edce1fe04e59693b3630b6b963902f8b43b60c32c09ea8911d021b2b8f0735728e7dc339c61969cc4d02df12d55d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
e185a6a94ffd6641576c354f71c03510

SHA1
5e1712c5e335e34a6a0fbcd20a9262c2cc0f3ad4

SHA256
25c20f6a62adc8a38f7df1ff47b0deb565e5cfa1b3fc85378d66221d1ef151c8

SHA512
b9810cb93e31cbc54f26d6ac02276a296c60ac670f3a0f0352f3bc21092e6d02b27ba70859f179de9887de4ad1e35b1288562835bf0794c5cf237d55969ea459

Download Submit
C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build2.exe
Filesize
277KB

MD5
8dae8b6a6be6e3527183594d1c26a2d3

SHA1
b87e40cee60869a36e79c88c8a3a34baf0bc4889

SHA256
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

SHA512
0bf065700db647efba39a13a58242a595907e6c11885575cf0bdad9e23ab40583c8a6535464e46d75d075e20d88b7a6305a761df9da787fdc8728483dd48f96e

Download Submit
C:\Users\Admin\AppData\Local\5848b433-d199-4bdf-b9a8-5dcdfd001ab6\build3.exe
Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
C:\Users\Admin\AppData\Local\f65150aa-3548-419a-8cad-0bbc4dd9089d\6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531.exe
Filesize
785KB

MD5
a12e55075d81449f86b1ffb157c11024

SHA1
0eb60fb510d7bdc36ed0775afc5b69dd9d24764c

SHA256
6f9a3635f4ac67f1de6abe2e6c8842fd984bf17316be0b2bffb23eb2e9a38531

SHA512
3a501b37e70e6e8b40f481c88aee3b39f9d9fc065650d4ef6832a765287bc5db7ca0ac2489637309eceeb8c4bf2bfea60824b88be876285b65a7d3faa0167dd2

Download Submit
memory/1884-95-0x0000000000AB0000-0x0000000000BB0000-memory.dmp

Filesize
1024KB

Download
memory/2352-115-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/2732-15-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2732-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2732-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2732-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2732-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2996-81-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2996-80-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2996-75-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3120-20-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3120-21-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3120-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3120-38-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3120-28-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3120-85-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3120-32-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3120-22-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3120-69-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3120-27-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3180-53-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3180-52-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3180-71-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3180-48-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/3696-1-0x00000000028C0000-0x0000000002953000-memory.dmp

Filesize
588KB

Download
memory/3696-2-0x00000000029F0000-0x0000000002B0B000-memory.dmp

Filesize
1.1MB

Download
memory/3892-50-0x00000000006C0000-0x00000000006F1000-memory.dmp

Filesize
196KB

Download
memory/3892-47-0x0000000000760000-0x0000000000860000-memory.dmp

Filesize
1024KB

Download
memory/3896-76-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/3896-77-0x0000000000A20000-0x0000000000A24000-memory.dmp

Filesize
16KB

Download
memory/4316-18-0x00000000027D0000-0x0000000002872000-memory.dmp

Filesize
648KB

Download
memory/4776-116-0x0000000000AD0000-0x0000000000BD0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads