Analysis
-
max time kernel
170s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-de -
resource tags
arch:x64arch:x86image:win10v2004-20240709-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
13-07-2024 18:50
Behavioral task
behavioral1
Sample
samples_pcap.zip
Resource
win10v2004-20240709-de
Behavioral task
behavioral2
Sample
25af3ae9f4ebe5413b0ca1080b69b0ca.exe
Resource
win10v2004-20240709-de
Behavioral task
behavioral3
Sample
payload.pyc
Resource
win10v2004-20240709-de
Behavioral task
behavioral4
Sample
25af3ae9f4ebe5413b0ca1080b69b0ca.pcap
Resource
win10v2004-20240709-de
Behavioral task
behavioral5
Sample
decryptor.exe
Resource
win10v2004-20240709-de
Behavioral task
behavioral6
Sample
decryptor.pyc
Resource
win10v2004-20240709-de
General
-
Target
25af3ae9f4ebe5413b0ca1080b69b0ca.exe
-
Size
11.3MB
-
MD5
25af3ae9f4ebe5413b0ca1080b69b0ca
-
SHA1
c34e2a2d8ba0aaea3913227de0cbf87cad4ebd1b
-
SHA256
2d95507aa1ea5d2a6313bc5c201cf76e6aae4c207aa0fafe8f1fcb03e94102ec
-
SHA512
b7194be16c8d4db0fc8305165c6d0e0aa6684b36c58855d9fab11e0d59d8bf004475df9932588cabebeff7d4f9a71dfa6bd8e985cfde1e318eb34e6880960ff2
-
SSDEEP
196608:ZDgEmz555jYu/mmWeeOuWJysVYvsOFDeECRl2Ewf8jI48RmU/3ZlsPv+dvSh8CDw:Pmz51TWeeDWJVHykUtN3ZWMp
Malware Config
Extracted
C:\Users\Admin\Pictures\README.txt
1sd2WD1fEJnUPkGgfTEciWENKtLeUGMQe
Signatures
-
DemonWare
Ransomware first seen in mid-2020.
-
Loads dropped DLL 34 IoCs
Processes:
25af3ae9f4ebe5413b0ca1080b69b0ca.exepid Process 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
25af3ae9f4ebe5413b0ca1080b69b0ca.exedescription pid Process Token: 35 3656 25af3ae9f4ebe5413b0ca1080b69b0ca.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
25af3ae9f4ebe5413b0ca1080b69b0ca.exedescription pid Process procid_target PID 3032 wrote to memory of 3656 3032 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 86 PID 3032 wrote to memory of 3656 3032 25af3ae9f4ebe5413b0ca1080b69b0ca.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\25af3ae9f4ebe5413b0ca1080b69b0ca.exe"C:\Users\Admin\AppData\Local\Temp\25af3ae9f4ebe5413b0ca1080b69b0ca.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\25af3ae9f4ebe5413b0ca1080b69b0ca.exe"C:\Users\Admin\AppData\Local\Temp\25af3ae9f4ebe5413b0ca1080b69b0ca.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3656
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5346613b7b5476bc5e0f2052337096745
SHA130d6f7dbeaca01e4b68c62441fcd7e96e5e3c318
SHA2568e321257df73855dd2c676211bc701417615036486d86c26a2d534eb3d012cc2
SHA51215923a468a68f89de1e023e788d0a5ce924cde0211d31a1d0244b01b938634988ea1cae677c8c0f0b7fbf60ea80bcfa0998869a5b5a4111ac641c9365b73c8fb
-
Filesize
33KB
MD529dc40ca28734062927e35f159045d00
SHA120b99cc2e47dee0588b4b3e3620d9adaa51dceb1
SHA25662a8dfd622505d3961b53ec718d4b1fa7932996921a70e5043d28c82014c958f
SHA51230e19fc9b24bcfc8c78452a20011769b8bb45ba49b98892b61fe1e401dce46099e67b6c199acbd480e4fdba75af7bfa6ae9a6915cf08397f0456c5ecb44da765
-
Filesize
12KB
MD5975677038380fe2055348ef1cfead173
SHA1fc13d734e4a762692b4763b0bb69f54f65961baa
SHA256183c2b948acfee01ee53acdbcfd5ea1161819dd91e26a711f6bcae54ea4f1d68
SHA512a84a1a1babc5e29fe3b3b52da550506b4a51d9974c044cae977d22082b9293f72c55339b936b4b01e13ac7f482fd15bac20129ed008421e00270275970548447
-
Filesize
12KB
MD5eaeb30f73165bef13c17703e524ba4e7
SHA1375396d0d6287739a78d192b6c99f63adb850621
SHA25637dceb92e4712f70725b79309e1b3313c9a6fe4f0129eb873ec283f8a4fc966a
SHA5126a8997a2bd80c62cee369636b8e33130ab983b5a58211901312624d961fd8c2630eee10df7891bc87bfc51c85e6fae3eec1e7537c35859604db754084bfcf226
-
Filesize
13KB
MD59c4f7079923415405bdc57170343d276
SHA1a7c5fc789c34717efdf18afd6ad80aa638285a3e
SHA2560a3d953bbecd62553ec35ccd2b5e97e54849171ae3bec86361f18e5641f51cb4
SHA512fe950abae14646fcafa417395361cbeda0b9f939fc5a8cc9610791ffc7d37d6ea3f0ccb59d3b541afdf2cfea5477b612ca2881bce2aec011165c521c6ae4570b
-
Filesize
10KB
MD5dc7b8a32b583dddd095e4a586790e196
SHA1899addf5f7160c3e9dcf0b70a277b37f9cfe1a99
SHA2561e14ce917a8fda673def4e59ec95f3cbebc053adee0f4c1916b6cd580dc5451a
SHA51204a8cef79f8f644af9daf937c20c1372eea55c747e2e3ebc7511263cc6d803ca5d959f856bcab3d1df8ac98939b2eb66c5ae506418f8317475b566480fe32fb2
-
Filesize
14KB
MD5e53daac3d85f0601b1aea2eca1af10a0
SHA1f305f7b07835c1f25bc5c9e9edb49c465b420046
SHA2567154dcc37ba077948ce7030627933c230e6ee52e32599b45d1d8bb8012b9e52a
SHA512c5cbf4d8f639c719dbe2f16d0409fb22b4db220670ddf4a56f91cee81d8944ed9b7830d6753689c57295418a8aa385fec5b325ce5293e968436515a7cfed2487
-
Filesize
11KB
MD5f61b7704ddc6e8a3cdef746ce273e9b4
SHA1724ca28ece5e600397b37ca92ab73d8ef28420d1
SHA256bb04cfa6485c766cc980b317c4bc6afa776b9fb2f550cd24d4d31091942aa579
SHA51256b1f4f6aa275303afdd1ec292f4f5908bb2eae0d71236cb00ade785c74ea0180f494c78a73269c8a0532e4daa71cd9a5cbebde5db3788d93f343ac7f53bcae5
-
Filesize
14KB
MD580bcd0e98ccd489062d84d9fac968bdb
SHA14754c9ec593ff821c9249053eb5e257ccc6dc630
SHA2564fbdf3c3057e8eef60fa7382be1c303db96c06d3d846723ce19a5982d92d0179
SHA512f82a856bf72c3bd9906992d0733e4b0e6ec6d183e7557f431e2d8ed6f5a058f7ad1e7a9f4abf787f40bda800757dc03a64454df3183a1626096e78e85a0c6ed5
-
Filesize
15KB
MD501c4ff8f2c1b7de289412e0b991fc3ea
SHA1cf61c41da1d0828c585b00f1fe1a5806dfca4abe
SHA256f65db1b2870dd515a21f0a54c41648e46c084f69397b9e490c851dfbe16a94d1
SHA51220c5440dc6c2580b65c5554f1613dfc2fef564739f8ab53032806894521ac5459c5b616d2c95a01dbc68177e38079059da8bae033c25379b8a08a6eb9069a2bf
-
Filesize
18KB
MD5130c190ea34d050d11ddb438aa85ee38
SHA1608e400fc970d132081149284336f065532f50b2
SHA256c8b01a857fff18abda746b703376373b5f9b66eec8e4fee124dbd0dfab73cdbb
SHA5123109d48cb3bea9d061dfe1c22e0795dac12c8d5468fd866286fc9349876843f5650159f41afbb3162ce060ccd258486ddc2622fdd041f1d5c0867ac6577f59d9
-
Filesize
20KB
MD5604980ebcb7a6f094fafbf7fbddb024d
SHA10062fe88f899f28df8682be6e7820db51eb7ae50
SHA256cd7909a8da1136c930daab4b496640f6a23f89c6423e9e1cad829874ff499c6c
SHA5122fc270a5aca29157d82e0be5be1eb49bf58edeefd8591b72f1a2857a78c2d534dd0b3ddcbf702d3b741170fdd86e5fa901d1028a3cde2e8518fbdbf0f2bbb354
-
Filesize
13KB
MD5e59c51d2f581a9cde3d914c3682925f2
SHA129def1c0410fe12164e6900f7416b4d292eb18f2
SHA256d74e95af0cab39cdda8b462ac7b887d8214f3474a107db0d06e159096c0c0f44
SHA51240c71556c557da8fa847d5515c63546e38f08479a00c3a7d9032f664d9e75a8fb209f61a83f909c76c6adc8a44a2ab2272af730dd22fcb3ab25af9765424fb68
-
Filesize
12KB
MD54ebe6bb08637535072163687bebdcb75
SHA17ff36c26315f57b996a1866f2c6a68cffcb0638d
SHA2561435996cb9b84ffe2ebe2aa415bbae70708a052faf6d7c90dc8f40c979e03f66
SHA5123d60e6532f6af2e1e84163cc052de6691b51d191a519d620d7c40cc7295827a62c2263d86edce61fc4329d261cde9413143c630d077020c9d546ddc34ee00ee1
-
Filesize
12KB
MD5ce04b6e8504eeb82439db577b45cd064
SHA179a6e03f6e4a453497fdc0bd1c8da59992a052e9
SHA256d51ad472f474f02d03fac74fd7c13b57158227ac685494667cb9f1eb7c0ea313
SHA5125647e71dcfa00d2dc56b416bf52657207d7009066eed78c5d60c68b54c333e180fa7c1445d15dcf52237a635c7ff050236a883e33de3a6b2b08078ea731c4d80
-
Filesize
10KB
MD5abe63928bac4999e03f2499f0285cbe6
SHA1c85b49c25bceb3a9089d668af947f60794bec804
SHA256f86f141433cdbae6eddc1190be1e64ba9c205c65cb5d6af9d513315d0a4ac85d
SHA51252df415b1b3f05c86a9eb3319f40741cfa97e43f2fbe8263060b776938aadf1ee253de489e286d36b331abce40e0f95bd03f230506a917f94be1b6f691e14945
-
Filesize
10KB
MD58b0290798b02b21fb79521c7914b24f7
SHA12f7ab160f2bf26734ecffecba69889035e3bd930
SHA2562c21a97fb28c49b2d92ab0f6e7b3a55a821bc465ddcd4e29558a1d063d9fe5c1
SHA5129898575c8894599069877bbff9109b28ca624f5bb1ac88a623a5de4fa40a8e02c64dfbb2c142aac1a65ec6b7fa24c7f9399c28083a666e18fd68ea5b2e24a81e
-
Filesize
2.5MB
MD570398840c51be1f97b011b0d5f6116e2
SHA1bb303242a812444e14900724574f115601820b9b
SHA256ca0adeb0602b3574b93f17a2c2d7c0c0046ea26a46ee8046149ec2bf2ad80ef2
SHA512968d7a8075c09b5969044fd6258aa81a7f00cd901a172c8cbd45147621c8902f787a5eba6c6f8a010aa4db8bc211db769c94d71edb8b3c12907180859ed8bac0
-
Filesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
Filesize
87KB
MD58b40a68ae537c0aab25a8b30b10ab098
SHA11c8ac1f7f5c3697c457dd98f05296c2354ff7f55
SHA2560b86ef4810d53e79f1d934b427fdbacf3792eebb37ed241bc89148238af763fa
SHA512620ad61ff05c73adee4ac8f4b88a3880c11893eaac77ccca4e88edb29b492366a5bcf813d18628f005730f7e45ce373af9275776ea768b67b8d0e3bc62949229
-
Filesize
131KB
MD59a69561e94859bc3411c6499bc46c4bd
SHA13fa5bc2d4ffc23c4c383252c51098d6211949b99
SHA2566bbde732c5bcb89455f43f370a444bb6bca321825de56f9a1f2e947b0a006f1c
SHA51231d9e3844f1b8e72ec80acd1e224a94d11039c130e69c498a668e07e0d8bba8d1ed1ebe0b7a16376ca597d0e2b74a0d5e3bf53d1cbadf5bf099d3bf78db659a4
-
Filesize
38KB
MD51f77f7a5f36c48e7c596e7031c80e4ff
SHA179f86e31203b60b3388047e39a2a26275da411f5
SHA25630dfbd97883b1545513ca5bb857a9aad6e9bf4b8b4272569818346eaf25033f7
SHA512b647e820ae4854921839a6cc92610fd63ef79623d442fd17503a39ca145dfd6cde3719c50473c0c74fe487f980b12e90bd3d3beb5729fa5498a357d44f81809c
-
Filesize
251KB
MD516fb5a2363ce8dd12a65a9823a517b59
SHA159979d9195259f48c678cdaa36b5efee13472ff5
SHA256bb78ca0dd1478027e2e9f06f56fc7c3cc6f157b4151562d58a7f6646e463fcc2
SHA512d9801cdd8cc9809781b79882a226ee7a56d93eac0181295c80cb1f088f0fbf46e3eb35c7d8ff208dbd5a3e93a190a04c48fd254c9971a3740b020547973683e1
-
Filesize
74KB
MD50ea1df6137ee3369546a806a175aecf4
SHA195fd1ad45892cb9e655bfa62ca1be80a0b9b2d43
SHA2566fcc31573ae6b380db1d4e23731755465fd2cee0856e7a6c0e396759bcbf73b5
SHA5126497fdb86ac69f6551a7794c090ca695bf22eb647b7a503fa23d7944ad375f061429f17e2ea043c809460e7cb9fc3df77c7bfe0b64f00ddd65de1aa744d3adcb
-
Filesize
67KB
MD5e994387279fec56a0eda4ca03eec759e
SHA1f3a3872b42c7c5bc3379a605dac398e8596e1179
SHA25601604c20b2ef42ed854c84c75a4227a844f543e54e1c05949281f9adabb762ff
SHA512f005e4916d0fb468c70946ca884cd38870a74dd8936ca49925e79cc0aa0458ca578b61e0be436aa2497e98c45f95513e14085289746f41027a2bfec540d3dc79
-
Filesize
764KB
MD5e5b66f29455a81c4d9935e36d23df0ab
SHA148902a5d77168e17dd5a5dda4dd77147b31d080e
SHA25609e423ddbd85bda67b0bdd2848ede518dc550b9b8d9f148c89391ab6bd178d9f
SHA512b59ad7615295a23f9da421ee34f45f8f451d477919c9f6e322de5cd25b8ab4023b4960eca3bdbf67729a130cb2794616df451e17d88bee5e5139608d3067ee89
-
Filesize
3.2MB
MD5bf83f8ad60cb9db462ce62c73208a30d
SHA1f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e
-
Filesize
1KB
MD522a0ccba48fe09df9b1a9dc4d03348c8
SHA1b83b7b140333e5fcb70bf361e717453982f8be1d
SHA256d4dc6e1c6191a54fd372aa0bb6c8db946d4be94b70142d0d9c3aab4d6b11d28f
SHA512633abf3a33f13e21566d7e0ea1d1fccd52fca5d5237202e0266ed46f539a8354b877487f422b29e2082b62f4adc8acf1487620f6b60e417f4d91663e826eef7b
-
Filesize
3.6MB
MD586af9b888a72bdceb8fd8ed54975edd5
SHA1c9d67c9243f818c0a8cc279267cca44d9995f0cf
SHA256e11aa3893597d7c408349ebb11f47a24e388fd702c4d38b5d6f363f7ad6e8e5f
SHA5125d8fd9040f466e23af7f17772e3769ad83c5f55f8c70dcc3cfb1f827e105f0f4e6133f0e183fabc67dd44799495c47f931bf92546342b30b9c4a5c2b4aeee7c7
-
Filesize
26KB
MD5e1d0d18a0dd8e82f9b677a86d32e3124
SHA196a00541d86d03529b55c1ac5ff1c6cfb5e91d1e
SHA2564595675949851bd0ff65521e936647fcc5c8d2f32f0ac2641a262fb6323896dd
SHA51238e3b6b23ebcbdc60eeeed0bf3dddc69004a1ccd4a2486f3a9f8c0d4624b690e2e5704e3fe05bf1bf2c900bf4f5bc9439f45f3c02fd4c67783056b3da15e0f56
-
Filesize
1.6MB
MD5c0b23815701dbae2a359cb8adb9ae730
SHA15be6736b645ed12e97b9462b77e5a43482673d90
SHA256f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
SHA512ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725
-
Filesize
1KB
MD55900f51fd8b5ff75e65594eb7dd50533
SHA12e21300e0bc8a847d0423671b08d3c65761ee172
SHA25614df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
SHA512ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc
-
Filesize
1.4MB
MD5fdc8a5d96f9576bd70aa1cadc2f21748
SHA1bae145525a18ce7e5bc69c5f43c6044de7b6e004
SHA2561a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
SHA512816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c
-
Filesize
971KB
MD51eb17f650462eea820f4cd727d2d3ab1
SHA1688f59160589ffa293502bffcd5c0e62e1993903
SHA25624968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
SHA5124b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
-
Filesize
690B
MD51bdcdadff52738118b8756668b9d2c19
SHA1d3ae0b6f436658897ebde5936905958baa345fd2
SHA256ae7212ed43727581a3cd2b6a505a494063e325d347704a405acbfea27ee4a0f8
SHA512a53b1fd0a67aa17fc70a0ae5dfb1fb3692db4fe70c83f60cbdca2d398730130b1517462ea1ce59239dab3f76b699a3ad45941310423cddc3badddc726e0246ac