Analysis
-
max time kernel
21s -
max time network
32s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
10-06-2024 17:27
General
-
Target
Mydoom/Mydoom Ransomwares/dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
-
Size
1.8MB
-
MD5
057aad993a3ef50f6b3ca2db37cb928a
-
SHA1
a57592be641738c86c85308ef68148181249bc0b
-
SHA256
dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876
-
SHA512
87c89027d60f80e99c526584fa093620b3f099151170362424ad78f5e4d7184bd9f2d627ec8463ca202127835f435dd4f85bf2b0d9351593c688855f0bbaffbb
-
SSDEEP
49152:BY/3BNLViG5jQWArXncSxhBfV7xLE1t+XgWJz5qtAj6R:BwgG5MWMX7h8+Uw
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\Adobe\# SATAN CRYPTOR #.hta
Ransom Note
<html>
<head>
<title>SATAN CRYPTOR</title>
<HTA:APPLICATION
ID=""
APPLICATIONNAME=""
BORDER="DIALOG"
MAXIMIZEBUTTON="NO"
SCROLLFLAT="YES"
CAPTION="YES"
SELECTION="NO"
INNERBORDER="NO"
ICON=""
SCROLL="NO"
SHOWINTASKBAR="YES"
SINGLEINSTANCE="YES"
SYSMENU="YES"
WINDOWSTATE="NORMAL"
/>
</head>
<script language=javascript>
var winWidth = 800;
var winHeight = 600;
window.resizeTo(winWidth, winHeight);
window.moveTo(screen.width/2-winWidth/2, screen.height/2-winHeight/2);
</script>
<body bgcolor=buttonface text=buttontext style="font: 10pt 'Tahoma'">
<div style="font-weight:bold; font:16pt; text-align: center" id="Tittle">Attention!</div>
<br>
<div style="padding:15px" id="SubTittle">
Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the cipher key recovery is impossible!
<br>
<br>
To decrypt your files you need to buy the special software - <strong>SATAN DECRYPTOR</strong> and your <strong>Private Decryption Key</strong>.
<br>
<br>
Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.
<br>
<br>
If you want to restore files, write us to the our e-mail: <strong>[email protected]</strong>
<br>
<br>
Please write your <strong>Personal Identification Code</strong> in body of your message.
<br>
<br>
Also attach to email 3 encrypted files for free decryption test. (each file have to be less than 1 MB size and not have valuable content)
<br>
<br>
It is in your interest to respond as soon as possible to ensure the restoration of your files!
<br>
<br>
Your <strong>Personal Identification Code</strong>:
</div>
<center>
<textarea style="overflow:auto; font:10pt 'Tahoma'" name="TextArea" rows=10 cols=120 readonly>5354000000019B0400008FB90AAD48D581AE7DB065C5C2F99FD1E256CD68DA6E587A080F8EE44F200FD91309F52F717C272ED5AD8A9AD27911DF722D8A0927B89083D0B878091E7F6D0D99E966940B1CCBACE3C42D74DDF4CB2422FBBB67EC1782A01F0D8F129E8AB3EE32B9C4B4ED28B7D622316CA68539F07BF90BF61BCFACB72809D76E9B83C4E6336E3AF99A36FDFE59A6C19A4A6E7C2DD9DC766E32CA07E4FEE706851C10222D1BEBB6E9F42E85445A680C990586B7597C6D68FF0B4A2F3B96687829A21BBF3FDA6273F6C739961EE8C939AB59AE14CDFCA3C60F0129040764641D0D3EFFFBAD9BA9494608F1EF73201FF530FF83B41A283E522BE484177FC0E5807B8D845A628DD2E72005267232E55F514932F1A5D372E94DC603542FC81E47BAFE27CA30893F4CB4E1AE252C16E88AED5B764B924DCA3F2C6D3019BF8F492EB98F58F1595AB82AD9EF9DC571FA52A3B6F00FE36632E65761AA4914718336EC54C18F9A9B4752F9FD44AE589A31D53B88C6E8327126C48082652A06A360D124C9265D4939EB43D0CAA331889DEE5F99111616AE09F08CDD71865AAC30738113A66BA4175E579D7C90A7F9BFDA908D7C51B99CC1916C3AA5C154A962F7ECFA72DEB2B55974F76021AE9ECA5B75688C7FF8897380D777C237D28C85BBDAB572B309782C4E7065E4628CA6631ECD52DF4E15B8A230050D139839078CD8CB0399208D7F1CB68F9EFB5D6ED4B7672F010C95B4FB823C4A3BEA779B9EDFAB31B1470E10D2BCF71E9F94BA9378152B472BC5989F81A33ED2171FB22550EC07F0AD3DED7AF7A6BA2AAE34801671DF25EFCA2A30053084FC2335831CF0ADE70E58E3AF08B8F021965F8A08498A3C91A6B0D30AA394E670A4630475C6095469B54D90883A7C76B23BA5773AC47A0706662DBB44181FA13D2B466B8340589C54ED88E3BA5B63C94DDF95385F778C9264F620EF7B90F33CDAB0DCAB66E8F2380C114BF70EC13CD3C4B8702BE153096C6B019B17B454EFF49261ADC74847C33901BD709D95E7B7B4C95E65437A52F0E19F25C892B3CE59CC659C5B3B85A9A5CF3ACDF7EFFF89D0040B90F8FD04855B415D7AE7D5186130DCBB95B0C897CB4E10D461C5F833867D0D60FC0EBD54AE1FC9293F9FF21B288F0C26488889F4E998C69124037A3CEA3A57F650A57C1DA3455BF1CE13C5CDC3E1C0ABD8C414114F314029B46B0C3EAE2A0E43A451BFB76176C6163D3443E0D9A638AD435085466AE7D94E58918DCBBDD1AE470B138A7EB1336A177DF3D7D7C350E9E1D1ECD67FBBEEB4B7379B183D5E8510DD6B04A99BE8616E53E118C0E300C9B9A80A4A4B48942DEA83ADBCE9EE0AE1EC77E117122CB9BFFEADEFC0D1A110A03C0C7B2F654295BE68FD7011E81D614FA74E8D1EC286BB3F7DC3E3105762F57CFAB7805203E5354875E360175D516E96FDF8424FC691D19371682298DAB1028814ACAB4F9B22D1E120A05FEF26F04926F50A5A85B1307AC8D1AE8915239B553F1CF2FD03289CD3CF1A74C518A9D1B189D9256109F94C659B67C0CF479FC8F9B20015E93400D14CD4DB78254BA2159EAA31A50622395453EC40EB6AD1F736F44220A8F74D6534BE3DABC533C85A4492D1C3BF17ACC3A5E9039E86839FD56D81765730CC65F6DC17EE95EC0A889E4A2B0DAA2167E1F39A8B1717AD040000</textarea>
</center>
</body>
Emails
<strong>[email protected]</strong>
Extracted
Family
zebrocy
C2
Windows XP Professional x64 Edition
Signatures
-
SatanCryptor
Golang ransomware first seen in early 2020.
-
Zebrocy
Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.
-
Zebrocy Go Variant 2 IoCs
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops desktop.ini file(s) 27 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mydoom\Mydoom Ransomwares\dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe"C:\Users\Admin\AppData\Local\Temp\Mydoom\Mydoom Ransomwares\dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ver2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\Mydoom\Mydoom Ransomwares\dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Adobe\# SATAN CRYPTOR #.htaFilesize
4KB
MD52464917d8796416fc939f3527ac0cc8c
SHA12480af9f25b0c1c0d12e7423c3ac7040eb925051
SHA2566fca62af29872d89262b047f48a2144f72dc3b64d35f3eae90d6052309868a34
SHA512998794300c860c88fe48b69495ad0a26a0c24348bed3f5ba9b0e7b04bb8ee8a27263ea58a0b57790f93f3bfb8cdd1d3b0d1835e09bd64b270722601e1dff5ddc
-
memory/2460-0-0x0000000000400000-0x00000000008D5000-memory.dmpFilesize
4.8MB
-
memory/2460-6455-0x0000000000400000-0x00000000008D5000-memory.dmpFilesize
4.8MB
-
memory/2460-6457-0x0000000000400000-0x00000000008D5000-memory.dmpFilesize
4.8MB