cerber | a58b1f94ba24a2d7f06c2b7a9840243c4e1b75b1b580cf1ce4c5d9af69cedc85

Analysis

max time kernel
20s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tXauTiJr.exe
Size

521KB
MD5

464c348f1bdf66a75c6b0d51256e916c
SHA1

fa7f683e451ab0a0c6c18a4dde7b9bbdde72ff27
SHA256

a58b1f94ba24a2d7f06c2b7a9840243c4e1b75b1b580cf1ce4c5d9af69cedc85
SHA512

cb07284fd3d33eef29f761fd0d044a9143b9e934eff49a625290c4da23580c1b0bb1f4cd9d5e574c698fbf791d13aa476be2a550baebb4f925ef019015710233
SSDEEP

6144:8a/Z+6VHFnEXbw2Y3h3NWqU/xdwpN8T4LUEDW9VXnHFudT7coWspLaIZ1ZT:8a/h8w2UNiX0gEOpnHFutV5n3

Score

10^/10

cerber defense_evasion ransomware

Malware Config

Signatures

Cerber 3 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	pid	Process
		1132	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		AMIDEWINx64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	tXauTiJr.exe

Executes dropped EXE 2 IoCs

pid	Process
3568	AMIDEWINx64.exe
4212	AMIDEWINx64.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
4376	taskkill.exe
1132	taskkill.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3772	3416	tXauTiJr.exe	93
PID 3416 wrote to memory of 3772	3416	tXauTiJr.exe	93
PID 3416 wrote to memory of 1532	3416	tXauTiJr.exe	95
PID 3416 wrote to memory of 1532	3416	tXauTiJr.exe	95
PID 3416 wrote to memory of 4620	3416	tXauTiJr.exe	96
PID 3416 wrote to memory of 4620	3416	tXauTiJr.exe	96
PID 3416 wrote to memory of 3968	3416	tXauTiJr.exe	99
PID 3416 wrote to memory of 3968	3416	tXauTiJr.exe	99
PID 3416 wrote to memory of 924	3416	tXauTiJr.exe	100
PID 3416 wrote to memory of 924	3416	tXauTiJr.exe	100
PID 924 wrote to memory of 1132	924	cmd.exe	102
PID 924 wrote to memory of 1132	924	cmd.exe	102
PID 3416 wrote to memory of 868	3416	tXauTiJr.exe	103
PID 3416 wrote to memory of 868	3416	tXauTiJr.exe	103
PID 868 wrote to memory of 3568	868	cmd.exe	105
PID 868 wrote to memory of 3568	868	cmd.exe	105
PID 3416 wrote to memory of 5048	3416	tXauTiJr.exe	106
PID 3416 wrote to memory of 5048	3416	tXauTiJr.exe	106
PID 5048 wrote to memory of 4212	5048	cmd.exe	108
PID 5048 wrote to memory of 4212	5048	cmd.exe	108
PID 3416 wrote to memory of 1992	3416	tXauTiJr.exe	109
PID 3416 wrote to memory of 1992	3416	tXauTiJr.exe	109
PID 1992 wrote to memory of 4376	1992	cmd.exe	111
PID 1992 wrote to memory of 4376	1992	cmd.exe	111
PID 3416 wrote to memory of 1496	3416	tXauTiJr.exe	113
PID 3416 wrote to memory of 1496	3416	tXauTiJr.exe	113
PID 3416 wrote to memory of 2588	3416	tXauTiJr.exe	115
PID 3416 wrote to memory of 2588	3416	tXauTiJr.exe	115
PID 3416 wrote to memory of 3592	3416	tXauTiJr.exe	117
PID 3416 wrote to memory of 3592	3416	tXauTiJr.exe	117
PID 3416 wrote to memory of 3536	3416	tXauTiJr.exe	119
PID 3416 wrote to memory of 3536	3416	tXauTiJr.exe	119

C:\Users\Admin\AppData\Local\Temp\tXauTiJr.exe
"C:\Users\Admin\AppData\Local\Temp\tXauTiJr.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM WmiPrvSE.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS %RANDOM%%RANDOM%%RANDOM%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 21832400123217
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:3568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV %RANDOM%%RANDOM%%RANDOM%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 21832400123217
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:4212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM WmiPrvSE.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys
  2⤵
  PID:1496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys
  2⤵
  PID:2588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
  2⤵
  PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe

Filesize
452KB

MD5
c4d09d3b3516550ad2ded3b09e28c10c

SHA1
7a5e77bb9ba74cf57cb1d119325b0b7f64199824

SHA256
66433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3

SHA512
2e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2

Download Submit
C:\ProgramData\Microsoft\Windows\amifldrv64.sys

Filesize
18KB

MD5
785045f8b25cd2e937ddc6b09debe01a

SHA1
029c678674f482ababe8bbfdb93152392457109d

SHA256
37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

SHA512
40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

Download Submit