Overview

overview

10

Static

static

3

Bit Paymer.exe

windows10-2004-x64

10

Resubmissions

18-07-2024 07:25

240718-h84wjs1hpb 10

18-07-2024 07:19

240718-h51pqa1gng 10

17-07-2024 20:55

240717-zqkhmaydmq 10

17-07-2024 19:21

240717-x2pwdaycjb 10

Analysis

  • max time kernel
    180s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-07-2024 07:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bit Paymer.exe

  • Size

    92KB

  • MD5

    998246bd0e51f9582b998ca514317c33

  • SHA1

    5a2d799ac4cca8954fc117c7fb3e868f93c6f009

  • SHA256

    d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2

  • SHA512

    773d9838be9c09bd43a22aa1eada8f623f95739b21828712236a4a209c6d9266647ef43592d072d68399224965253c37f9ce9ef36e46e8191169c03ac7789130

  • SSDEEP

    1536:tacFdjxs2TlWlpnXv91nhixG8/lA5jG8387SpK6jXOMVHoi5e+vRb:taqJC6lWlpnXv7nhixhlAU83VwMCifvR

Score
10/10
persistenceransomware

Malware Config

Extracted

Path

C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.readme_txt

Ransom Note
YOUR COMPANY HAS BEEN SUCCESSFULLY PENETRATED! All files are encrypted. We accept only bitcoins to share the decryption software for your network. Also, we have gathered all your private sensitive data.So if you decide not to pay anytime soon, we would share it with media's. It may harm your business reputation and the company's capitalization fell sharply. Do not try to do it with 3rd-parties programs, files might be damaged then. Decrypting of your files is only possible with the special decryption software. To receive your private key and the decryption software please follow the link (using tor2web service): https://qmnmrba4s4a3py6z.onion.to/order/43e4593a-5dc7-11e7-8803-00163e417ea3 If this address is not available, follow these steps: 1. Download and install Tor Browser: https://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: http://qmnmrba4s4a3py6z.onion/order/43e4593a-5dc7-11e7-8803-00163e417ea3 4. Follow the instructions on the site 5. This link is valid for 72 hours only. Afetr that period your local data would be lost completely. 6. Any questions: [email protected]
URLs

https://qmnmrba4s4a3py6z.onion.to/order/43e4593a-5dc7-11e7-8803-00163e417ea3

http://qmnmrba4s4a3py6z.onion/order/43e4593a-5dc7-11e7-8803-00163e417ea3

Signatures

  • Renames multiple (9455) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe
    "C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Aoq3\eqxNBxP.exe 2
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Users\Admin\AppData\Local\Aoq3\eqxNBxP.exe
        C:\Users\Admin\AppData\Local\Aoq3\eqxNBxP.exe 2
        3⤵
        • Executes dropped EXE
        • NTFS ADS
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Users\Admin\AppData\Local\Zn0T:exe
          C:\Users\Admin\AppData\Local\Zn0T:exe 3 C:\Users\Admin\AppData\Local\Aoq3\eqxNBxP.exe
          4⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Drops file in Program Files directory
          PID:1972
    • C:\Users\Admin\AppData\Local\Idw:exe
      C:\Users\Admin\AppData\Local\Idw:exe 1 C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\net.exe
        C:\Windows\system32\net.exe view
        3⤵
        • Discovers systems in the same network
        PID:4532
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4488
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Aoq3\eqxNBxP.exe
      Filesize

      92KB

      MD5

      998246bd0e51f9582b998ca514317c33

      SHA1

      5a2d799ac4cca8954fc117c7fb3e868f93c6f009

      SHA256

      d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2

      SHA512

      773d9838be9c09bd43a22aa1eada8f623f95739b21828712236a4a209c6d9266647ef43592d072d68399224965253c37f9ce9ef36e46e8191169c03ac7789130

      Download Submit

    • C:\vcredist2010_x86.log-MSI_vc_red.msi.txt
      Filesize

      4B

      MD5

      76390d3429ba451f1e37daae6bc85b51

      SHA1

      c8e633f4a5ad8991f348fa8bf85dfec134e2c4dc

      SHA256

      31d694956ddcdb8b2d61ee7b91beb5af37ce0557b6ca44438d2c3ca9f96c56d9

      SHA512

      cff8a95d7efbabc3ac3c06b721166ac26254eadcbed6296bb17712be07c1b7245ab22fb9b558371b0a69e855451706180ef20ccb57f639cbe818c14d90bd3e54

      Download Submit

    • C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.readme_txt
      Filesize

      1KB

      MD5

      51fab08a170e3c398e696a5d36cde259

      SHA1

      b60d83b9db3831998bb5672e4a4a1610cf4e1cb1

      SHA256

      bab1199a9b43d11429c79f0b15c7e8c8d61ec612aca223aa66fd253eab11f1cb

      SHA512

      50b95e5bd31ab894e997773c374592bda8a0cf44f92c9b92aad8155928240c1a2d177f81bcdefe72d686413dd9494f8010f66f9e191b7a549fb99902c6f2c3d6

      Download Submit

    • memory/408-0-0x00000000009B0000-0x00000000009B6000-memory.dmp

      Filesize

      24KB

      Download

    • memory/408-11-0x0000000001000000-0x0000000001020000-memory.dmp

      Filesize

      128KB

      Download

    • memory/408-1-0x0000000001000000-0x0000000001020000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1768-14-0x0000000000870000-0x0000000000876000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1768-5891-0x0000000001000000-0x0000000001020000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1972-5892-0x0000000001000000-0x0000000001020000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1972-26-0x0000000000670000-0x0000000000676000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2488-19-0x0000000000C10000-0x0000000000C16000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2488-23-0x0000000001000000-0x0000000001020000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4488-1344-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4488-1354-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4488-1355-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4488-1353-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4488-1352-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4488-1351-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4488-1350-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4488-1349-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4488-1343-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4488-1345-0x000001C55F160000-0x000001C55F161000-memory.dmp

      Filesize

      4KB

      Download