Overview

overview

10

Static

static

10

eb82946fa0...12.exe

windows7-x64

10

eb82946fa0...12.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    45s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 08:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe

  • Size

    147KB

  • MD5

    448f1796fe8de02194b21c0715e0a5f6

  • SHA1

    935c0b39837319fda571aa800b67d997b79c3198

  • SHA256

    eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12

  • SHA512

    0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831

  • SSDEEP

    3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\sYMY1N6ah.README.txt

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: M8AL5cWJEU5CnMMPwCdt4x9NVn0ZY2uNtIgnKwkDJwdPbnanVROYFzGmgUCImexTGDmINYgSZXdlhM7D199lNMb294TGY2 Email to support: [email protected]
URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
    "C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini
    Filesize

    129B

    MD5

    7ee8bd10af44531ec37aac44f1d2bc8b

    SHA1

    776a97b79811859c79eeaff083e9645b44d1f342

    SHA256

    95db7639d06399ca6e4e60f064c09b1f7da3ccd9fe09c3256c3c260953442fd3

    SHA512

    adc6cc10984dd5913d43890048d3e099fc5c426b3e0968528e2abbfe2a67bf673c7f63208ef0d59b9f0c252c616c4c5d0ecca3cda06bd0da204d2646d616fc54

    Download Submit

  • C:\sYMY1N6ah.README.txt
    Filesize

    1KB

    MD5

    deb2e0756d331362d57ad9fe408c4ff3

    SHA1

    870865aad7c7cccafbca0c1f50f7eecaedbd4bf1

    SHA256

    1ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c

    SHA512

    e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    3e3c8063d2e0e9de685e49d27da413d0

    SHA1

    3b87a64c052ce92fcc60ec1ea91c473f2aaf38e6

    SHA256

    f396ea09607eb331aa2b3bed7723fa7040da94e416bf8d629fc87f9a4b712e77

    SHA512

    b7ef9a21d7153b8bd90efdfc8bf38cc374ff0de79bc4f7fea74b9f742365b9fb95c2ed228053dc608f3dbfc2de297897bce136b7664c5c86f41587374c8b606d

    Download Submit

  • memory/2388-0-0x0000000000800000-0x0000000000810000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2388-2-0x0000000000800000-0x0000000000810000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2388-1-0x0000000000800000-0x0000000000810000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2388-1632-0x0000000000800000-0x0000000000810000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2388-1633-0x0000000000800000-0x0000000000810000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2388-1634-0x0000000000800000-0x0000000000810000-memory.dmp

    Filesize

    64KB

    Download