Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw1025/03/2025, 15:06
250325-sg1d6a1px21025/03/2025, 15:01
250325-sd5jpsxyct1025/03/2025, 14:56
250325-sbdcfaxxgs1025/03/2025, 14:50
250325-r7ve6a1nv31025/03/2025, 14:46
250325-r5ab7sxwhx1025/03/2025, 14:40
250325-r2c9paxwe11005/02/2025, 10:25
250205-mgcefaslhw1005/02/2025, 10:17
250205-mbs51atmbk1005/02/2025, 09:15
250205-k785zs1pfn10Analysis
- max time kernel
417s - max time network
443s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
07/07/2024, 14:07
General
- Target RansomwareSamples/Cuba_08_03_2021_1130KB.exe
- Size 1.1MB
- Sample240707-rfgd8atekm
- SHA256 271ef3c1d022829f0b15f2471d05a28d4786abafd0a9e1e742bde3f6b36872ad
Malware Config
Extracted
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\!!FAQ for Decryption!!.txt
- Good day. All your files are encrypted. For decryption contact us. Write here [email protected] We also inform that your databases, ftp server and file server were downloaded by us to our servers. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss.
Signatures
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Cuba_08_03_2021_1130KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Cuba_08_03_2021_1130KB.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Cuba_08_03_2021_1130KB.exe >> NUL2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
!!FAQ for Decryption!!.txt
memory/800-4988-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-9718-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-0-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-1316-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-2002-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-2835-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-2-0x0000000000400000-0x000000000046C000-memory.dmp
memory/800-7236-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-4322-0x0000000000400000-0x000000000046C000-memory.dmp
memory/800-8957-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-1-0x0000000002270000-0x00000000022D0000-memory.dmp
memory/800-11034-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-12062-0x0000000000400000-0x000000000051D000-memory.dmp
memory/800-12480-0x0000000000400000-0x000000000046C000-memory.dmp
memory/800-12479-0x0000000000400000-0x000000000051D000-memory.dmp