cerber | 11c712b2b16eeb1652793fc8bad16d9177ef161398dceb95e136f8f2a349e56c

Analysis

max time kernel
112s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tXauTiJr.exe
Size

521KB
MD5

464c348f1bdf66a75c6b0d51256e916c
SHA1

fa7f683e451ab0a0c6c18a4dde7b9bbdde72ff27
SHA256

a58b1f94ba24a2d7f06c2b7a9840243c4e1b75b1b580cf1ce4c5d9af69cedc85
SHA512

cb07284fd3d33eef29f761fd0d044a9143b9e934eff49a625290c4da23580c1b0bb1f4cd9d5e574c698fbf791d13aa476be2a550baebb4f925ef019015710233
SSDEEP

6144:8a/Z+6VHFnEXbw2Y3h3NWqU/xdwpN8T4LUEDW9VXnHFudT7coWspLaIZ1ZT:8a/h8w2UNiX0gEOpnHFutV5n3

Score

10^/10

cerber defense_evasion ransomware

Malware Config

Signatures

Cerber 3 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	pid	Process
		2460	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		AMIDEWINx64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	tXauTiJr.exe

Executes dropped EXE 2 IoCs

pid	Process
4960	AMIDEWINx64.exe
2904	AMIDEWINx64.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
2460	taskkill.exe
376	taskkill.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	376	taskkill.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4616	4264	tXauTiJr.exe	87
PID 4264 wrote to memory of 4616	4264	tXauTiJr.exe	87
PID 4264 wrote to memory of 2800	4264	tXauTiJr.exe	88
PID 4264 wrote to memory of 2800	4264	tXauTiJr.exe	88
PID 4264 wrote to memory of 692	4264	tXauTiJr.exe	89
PID 4264 wrote to memory of 692	4264	tXauTiJr.exe	89
PID 4264 wrote to memory of 4708	4264	tXauTiJr.exe	90
PID 4264 wrote to memory of 4708	4264	tXauTiJr.exe	90
PID 4264 wrote to memory of 2792	4264	tXauTiJr.exe	91
PID 4264 wrote to memory of 2792	4264	tXauTiJr.exe	91
PID 2792 wrote to memory of 2460	2792	cmd.exe	93
PID 2792 wrote to memory of 2460	2792	cmd.exe	93
PID 4264 wrote to memory of 2528	4264	tXauTiJr.exe	95
PID 4264 wrote to memory of 2528	4264	tXauTiJr.exe	95
PID 2528 wrote to memory of 4960	2528	cmd.exe	97
PID 2528 wrote to memory of 4960	2528	cmd.exe	97
PID 4264 wrote to memory of 2044	4264	tXauTiJr.exe	98
PID 4264 wrote to memory of 2044	4264	tXauTiJr.exe	98
PID 2044 wrote to memory of 2904	2044	cmd.exe	100
PID 2044 wrote to memory of 2904	2044	cmd.exe	100
PID 4264 wrote to memory of 548	4264	tXauTiJr.exe	101
PID 4264 wrote to memory of 548	4264	tXauTiJr.exe	101
PID 548 wrote to memory of 376	548	cmd.exe	103
PID 548 wrote to memory of 376	548	cmd.exe	103
PID 4264 wrote to memory of 1724	4264	tXauTiJr.exe	105
PID 4264 wrote to memory of 1724	4264	tXauTiJr.exe	105
PID 4264 wrote to memory of 2144	4264	tXauTiJr.exe	107
PID 4264 wrote to memory of 2144	4264	tXauTiJr.exe	107
PID 4264 wrote to memory of 1956	4264	tXauTiJr.exe	109
PID 4264 wrote to memory of 1956	4264	tXauTiJr.exe	109
PID 4264 wrote to memory of 3524	4264	tXauTiJr.exe	111
PID 4264 wrote to memory of 3524	4264	tXauTiJr.exe	111

C:\Users\Admin\AppData\Local\Temp\tXauTiJr.exe
"C:\Users\Admin\AppData\Local\Temp\tXauTiJr.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM WmiPrvSE.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS %RANDOM%%RANDOM%%RANDOM%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 2233147329299
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:4960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV %RANDOM%%RANDOM%%RANDOM%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 2233147329299
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM WmiPrvSE.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys
  2⤵
  PID:1724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys
  2⤵
  PID:2144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
  2⤵
  PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe

Filesize
452KB

MD5
c4d09d3b3516550ad2ded3b09e28c10c

SHA1
7a5e77bb9ba74cf57cb1d119325b0b7f64199824

SHA256
66433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3

SHA512
2e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2

Download Submit
C:\ProgramData\Microsoft\Windows\amifldrv64.sys

Filesize
18KB

MD5
785045f8b25cd2e937ddc6b09debe01a

SHA1
029c678674f482ababe8bbfdb93152392457109d

SHA256
37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

SHA512
40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

Download Submit