Overview
overview
10Static
static
10TrojanRans...29.exe
windows11-21h2-x64
10source/Bat...er.exe
windows11-21h2-x64
7source/Bat...lp.chm
windows11-21h2-x64
1source/Cov29Cry.exe
windows11-21h2-x64
10source/Cov...v4.exe
windows11-21h2-x64
10source/Cov...ry.exe
windows11-21h2-x64
10source/Cov...en.exe
windows11-21h2-x64
3source/Cov...en.exe
windows11-21h2-x64
3source/Tro...29.bat
windows11-21h2-x64
10source/mbr.exe
windows11-21h2-x64
6Analysis
-
max time kernel
140s -
max time network
97s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-08-2024 01:52
Behavioral task
behavioral1
Sample
TrojanRansomCovid29.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
source/Bat To Exe Converter/help.chm
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
source/Cov29Cry.exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
source/Cov29Cry/Chaos Ransomware Builder v4.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
source/Cov29Cry/Cov29Cry.exe
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
source/Cov29LockScreen.exe
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
source/Cov29LockScreen/Cov29LockScreen.exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
source/TrojanRansomCovid29.bat
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
source/mbr.exe
Resource
win11-20240802-en
General
-
Target
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
-
Size
444KB
-
MD5
76d5900a4adf4c1f2ab8dbfd0a450c4a
-
SHA1
6177a27416519564ecb5d38093d61c9a81d3c290
-
SHA256
7adc1f7ff040628a600f99465bd70e71ad83fecfe60b0f1dadc84b5d262ff350
-
SHA512
286b05ff09d4e85856c251d56902486738d9b2457d9a56ea8a449195b349f2718816099f4602efba88dad592dd6cecefcd0748382888c3026dd585b3e46f0c6e
-
SSDEEP
12288:iYicHMPMDp8WrZtzlqQMB/FS/CiUF7RAfoSBjF:viuMPMDp8mtzbMFFS/CzKF
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1072-0-0x0000000000400000-0x00000000004FA000-memory.dmp upx behavioral2/memory/1072-5-0x0000000000400000-0x00000000004FA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bat_To_Exe_Converter.exe