Overview

overview

10

Static

static

10

eb82946fa0...12.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    256s
  • max time network
    274s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 23:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe

  • Size

    147KB

  • MD5

    448f1796fe8de02194b21c0715e0a5f6

  • SHA1

    935c0b39837319fda571aa800b67d997b79c3198

  • SHA256

    eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12

  • SHA512

    0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831

  • SSDEEP

    3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\sYMY1N6ah.README.txt

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: M8AL5cWJEU5CnMMPwCdt4x9NVn0ZY2uNtIgnKwkDJwdPbnanVROYFzGmgUCImexTGDmINYgSZXdlhM7D199lNMb294TGY2 Email to support: [email protected]
URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
    "C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\ProgramData\61A8.tmp
      "C:\ProgramData\61A8.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\61A8.tmp >> NUL
        3⤵
          PID:2380
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5104
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1718131777.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:3540

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-2447855248-390457009-3660902674-1000\AAAAAAAAAAA
        Filesize

        129B

        MD5

        d523ff1eae3d4687f3c478732e24a72f

        SHA1

        3aa3c7cb19a22256410e734a887cd666b65d79cc

        SHA256

        844b7f7c9dc9b2940ea70e054ba70c255dcff7823c61d8cdb3fa54edcc1abdfb

        SHA512

        f22690a67a39299b1c2832baa7e284fcb2cd55bcc6657a1a539e063fc30202a1ca357c744c04f389679434f6c314fd8b2aa416a94d657c0a4220d66f6ba28ad7

        Download Submit

      • C:\ProgramData\61A8.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        acd1d83fca87c6541d5451ea12c7b141

        SHA1

        eb1227e116b3239da37994ca07a32be27672f310

        SHA256

        1c3cf4f266aacbdb778ff3145754468c3d46cdde0fe03ae02f7863ef62eb188a

        SHA512

        6dc4ff55e6cd95f06dc6b4f72f3097ac4cf94acf3f087ca29e88984b0a314ae461f9d6d77c0a46a9ebe2633810aba153b8b7aa2bbd6e62cfb7c900e005e83ce7

        Download Submit

      • C:\Users\sYMY1N6ah.README.txt
        Filesize

        1KB

        MD5

        deb2e0756d331362d57ad9fe408c4ff3

        SHA1

        870865aad7c7cccafbca0c1f50f7eecaedbd4bf1

        SHA256

        1ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c

        SHA512

        e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-2447855248-390457009-3660902674-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        10f6521a44f0d4e31a8177968f1408af

        SHA1

        08bf0d7563440aa3dbb015f20bd1104f0fd69621

        SHA256

        182d7309a919daae4a9894bdc6c10bd0f4a1d970376d199ecb4da49855c9fc4b

        SHA512

        347ce8a699e83a2aa90ccc14156a5cfda5f2ed72d49db25b50f9c1f8bc03b94e2db9cf64a1c15c10e1ac28dfad2a3e3ea10f465e3005253833bcf08d22db42b0

        Download Submit

      • memory/2180-2731-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

        Download

      • memory/2180-2732-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/3716-0-0x0000000002E20000-0x0000000002E30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3716-1-0x0000000002E20000-0x0000000002E30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3716-2-0x0000000002E20000-0x0000000002E30000-memory.dmp

        Filesize

        64KB

        Download