Analysis
-
max time kernel
16s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
16-07-2024 13:57
General
-
Target
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
-
Size
147KB
-
MD5
448f1796fe8de02194b21c0715e0a5f6
-
SHA1
935c0b39837319fda571aa800b67d997b79c3198
-
SHA256
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
-
SHA512
0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831
-
SSDEEP
3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4
Malware Config
Extracted
C:\sYMY1N6ah.README.txt
braincipher
http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
Signatures
-
Brain Cipher
Ransomware family based on Lockbit that was first observed in June 2024.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\BF78.tmp"C:\ProgramData\BF78.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BF78.tmp >> NUL3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5d24bb62cae06bba19138b34a3a246feb
SHA17f45e97cd6c8ba7dc18d1a63a88d24a7888d1804
SHA256af7fa2864a30a9ceff551c70eb6315a83a1496a5ea5ae255353acde3566bd534
SHA51262ada7a5cb5dbc16fc10f7e91270f9d6ab1a0d2de114a0650e1506b50ae511a2ec4597e361b81dfb9c77d8ebe0366008d479828099df0202c0ab2142ec1ba5b7
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
147KB
MD564c6e02e4a7a00c1e22e59d003f50831
SHA1ac7906dcdccdb29d4d9af86c7eeb3abcf408e98b
SHA2564aec515943da3423ce92d3dd8cf05af7617e519f2a420c018f746e272afb1b6a
SHA512deeb7480651950ac03af4c253475c6890deaf342d9df1a0e2a8449896925687423fae28005cf71f1ae1d9a2835cda022d501eba3dbae909ef1b400ecd3affbdf
-
Filesize
1KB
MD5deb2e0756d331362d57ad9fe408c4ff3
SHA1870865aad7c7cccafbca0c1f50f7eecaedbd4bf1
SHA2561ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c
SHA512e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6
-
Filesize
129B
MD57cd84987a5558c1699973dc42878bdf4
SHA1302b6537fe114c85ae41b5c862b9d4f76e2b8bb9
SHA25686be24ea39b49e94b445dc866270147bf4de84df13eba6259b1e8af835b411b5
SHA5129e40ec2afc03a3decaf2c9210540dd36111f7b74281b8d37268ef516036337ce9e1840f025058ddf0db924be87434009aabe121d82e7edbfe1713980a77fefc3
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB