cerber | 3d99b167af0de94e2d01b587daf40a5a9bfe7ec5668b06bae5788f7bbce995ed | Triage

Sharing

General

Target

D3DX9_43.zip
Size

2.6MB
Sample

241005-3y3wqa1emf
MD5

12b90938788484c974680e0c3d973888
SHA1

2b140262f35dad6d47619cfb6b45b49a3c1c85f0
SHA256

3d99b167af0de94e2d01b587daf40a5a9bfe7ec5668b06bae5788f7bbce995ed
SHA512

5932193ba2c22b19f8e3a5715dc5f341dea911da2d9b55a4c66396154988a7912d6d783ac5e2c9b6406973e4f650449bfb7f915100f13b5ea7bf74422b302141
SSDEEP

49152:YDQbENF0ys/EoL6DGGzFu/GLQk6leRcEjt/552OI2nkCKeucH:qtFpWazFeGtRNj52OI2K4H

Score

10^/10

cerber defense_evasion discovery evasion execution ransomware

Malware Config

Targets

- Target
  
  D3DX9_43.dll
- Size
  
  2.3MB
- MD5
  
  7160fc226391c0b50c85571fa1a546e5
- SHA1
  
  2bf450850a522a09e8d1ce0f1e443d86d934f4ad
- SHA256
  
  84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
- SHA512
  
  dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
- SSDEEP
  
  49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW
Score

1^/10
behavioral1
- Target
  
  d3d.exe
- Size
  
  2.7MB
- MD5
  
  e001605fa695282a2d3170d8d9e956c9
- SHA1
  
  4544155daae0335ada1d05a509e43b8c0434ffc8
- SHA256
  
  003dc05c74dedfb83f73982173d2ed293a84a2af8a7ef8b6e6ff928119859a2e
- SHA512
  
  11642791791255eea62db5b5058e651329d9b537cc9ffd734702b5bf5207351ecc3bbdb3499acb3dc43e7937da8efd9e23b1e1ccfaa6a077bd747a40926d40d6
- SSDEEP
  
  49152:wy8J1anDS2TFQTnQT2QT9QT1QTXCbAAKrqgvWAtY3o41MBXcOz5dD:CxYw1aCkX23o41MBXc4D
Score

10^/10

cerber defense_evasion discovery evasion execution ransomware
- Cerber
  Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
  ransomware cerber
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2

cerberdefense_evasiondiscoveryevasionexecutionransomware