Overview

overview

10

Static

static

3

9c1b4c49ec...dN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 03:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9c1b4c49ecfd2dc93ee842591422483e0c573f115f8d17c5fb58f9130ee0c70dN.exe

  • Size

    1.5MB

  • MD5

    eae2c3ed7ce3e11a0668304b21077320

  • SHA1

    ab97d3d1b6120e4124b5c4f1188fa93118de84f1

  • SHA256

    9c1b4c49ecfd2dc93ee842591422483e0c573f115f8d17c5fb58f9130ee0c70d

  • SHA512

    7c556d89e4aee9250eced80ce8dcd05b7c3d57bcacaf263ffc5b71ec8f7aa28cf63b02871d1c3c4a9d46a75e3a9d5a67d8372f275aae2655804ab032ca4aae81

  • SSDEEP

    24576:tKWeNczWidc+ysoJfQdGky80RYk9vbQotm/SXlk4QBb3Isa20y:gczWrsoJgy8oYgvbH8/slZm3If2d

Score
10/10
blackbastadiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note
Hello! If you are reading this, it means we have encrypted your data and took your files. DO NOT PANIC! Yes, this is bad news, but we will have a good ones as well. YES, this is entirely fixable! Our name is BlackBasta Syndicate, and we are the largest, most advanced, and most prolific organized group currently existing. We are the ultimate cyber tradecraft with a credential record of taking down the most advanced, high-profile, and defended companies one can ever imagine. You can Google us later; what you need to know now is that we are business people just like you. We have your data and encrypted your files, but in less than an hour, we can put things back on track: if you pay for our recovery services, you get a decryptor, the data will be deleted from all of our systems and returned to you, and we will give you a security report explaining how we got you. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login: 4f80cd7d-b588-4df3-a267-724e8a3383b8 This is a link to a secure chat. We will talk there. Inside that chat, we will share a second designated link that only your special team will be able to see. For now, think about the following. This incident hits your network and is stopping you from operating properly. The sooner you get back on track, the better it is. See you in the secure chat.
URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Signatures

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Blackbasta family
    blackbasta
  • Renames multiple (10692) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c1b4c49ecfd2dc93ee842591422483e0c573f115f8d17c5fb58f9130ee0c70dN.exe
    "C:\Users\Admin\AppData\Local\Temp\9c1b4c49ecfd2dc93ee842591422483e0c573f115f8d17c5fb58f9130ee0c70dN.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
      2⤵
        PID:668
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:7932
        • C:\Windows\system32\notepad.exe
          notepad.exe c:\instructions_read_me.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:7832
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5040
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      PID:4600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\instructions_read_me.txt
      Filesize

      1KB

      MD5

      e7287666964d56a61a8b5c5eadf2a9a3

      SHA1

      8de2cad915b5899183f938ed806bd29711cb4d7b

      SHA256

      7b45fa54c6b542b268375e356f2d8c914984d3c2fc92fa681d2f456027820e90

      SHA512

      32d8c9071262faa8a1a0ed41cd9cc710ccc08a0ec1f7d39a5930d89317693e8575ea68894199815ad8c4fa04e3397b989922c15c81fdf3285bb32a064a7be811

      Download Submit

    • memory/3876-11-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-8-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-0-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-10-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-9-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-12-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-13-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-15-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-2-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-1097-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-25181-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/3876-25199-0x0000000001F50000-0x000000000209A000-memory.dmp

      Filesize

      1.3MB

      Download