Overview
overview
10Static
static
6DUMP_00A10...iR.exe
windows7-x64
7DUMP_00A10...iR.exe
windows10-2004-x64
7DgH5SjZFle...DI.exe
windows7-x64
10DgH5SjZFle...DI.exe
windows10-2004-x64
5Dumped_.exe
windows7-x64
7Dumped_.exe
windows10-2004-x64
7EntrateSetup.exe
windows7-x64
9EntrateSetup.exe
windows10-2004-x64
9ErrorFileRemover.exe
windows7-x64
10ErrorFileRemover.exe
windows10-2004-x64
10ExtraTools.exe
windows7-x64
7ExtraTools.exe
windows10-2004-x64
7F45F47EDCE...54.exe
windows7-x64
10F45F47EDCE...54.exe
windows10-2004-x64
10decrypt_00...00.exe
windows7-x64
6decrypt_00...00.exe
windows10-2004-x64
6dffde400ad...3d.exe
windows7-x64
10dffde400ad...3d.exe
windows10-2004-x64
10dircrypt.deobf.exe
windows7-x64
10dircrypt.deobf.exe
windows10-2004-x64
10dma locker 4.0.exe
windows7-x64
9dma locker 4.0.exe
windows10-2004-x64
9downloader.js
windows7-x64
10downloader.js
windows10-2004-x64
8dump.mem.exe
windows7-x64
6dump.mem.exe
windows10-2004-x64
6e0ff79cc94...ss.exe
windows7-x64
7e0ff79cc94...ss.exe
windows10-2004-x64
10e37dc428ec...ad.vbs
windows7-x64
1e37dc428ec...ad.vbs
windows10-2004-x64
1e5df2d114c...8a.exe
windows7-x64
10e5df2d114c...8a.exe
windows10-2004-x64
3Analysis
-
max time kernel
43s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:36
Behavioral task
behavioral1
Sample
DUMP_00A10000-00A1D000.exe.ViR.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
DUMP_00A10000-00A1D000.exe.ViR.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Dumped_.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Dumped_.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
EntrateSetup.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
EntrateSetup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
ErrorFileRemover.exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
ErrorFileRemover.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ExtraTools.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
ExtraTools.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
F45F47EDCED7FAC5A99C45AB4B8C2D54.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
F45F47EDCED7FAC5A99C45AB4B8C2D54.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
decrypt_0000000000000020-000A0000.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
decrypt_0000000000000020-000A0000.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
dircrypt.deobf.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
dircrypt.deobf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
dma locker 4.0.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
dma locker 4.0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
downloader.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
downloader.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
dump.mem.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
dump.mem.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad.vbs
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe
Resource
win10v2004-20241007-en
General
-
Target
downloader.js
-
Size
8KB
-
MD5
2fabecc77b10b39ff03f221f39f50c6c
-
SHA1
e66ab4015c360a0f0866ea840dbeb2ef4953c86d
-
SHA256
f6e2c1b42ce68165fd2cd8580daf47d594c4960fc8fb5cdbf1ec210e3ffae87f
-
SHA512
9c8bcaee59eaa6d9738caf9a61214e098438e5ecc352e8faaa7972625c3bce3f00eece4bd7b43587b09a5ef66c93778b42d0b39a7ef46aeca5d3f7da2a43384a
-
SSDEEP
192:E4/wMMuUYDKe5enZr2CU0eC+To2fOO0spxetRut64pB6BS:bMufcnZr2CU0etTaO7GtRut6UMQ
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\360390_readme.txt
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 5 3044 wscript.exe 8 3044 wscript.exe 10 3044 wscript.exe 12 3044 wscript.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2932 notepad.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2612 3044 wscript.exe 31 PID 3044 wrote to memory of 2612 3044 wscript.exe 31 PID 3044 wrote to memory of 2612 3044 wscript.exe 31
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\downloader.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\360390_tree.cmd" "2⤵PID:2612
-
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Admin\AppData\Local\Temp\360390_readme.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2932
-
-
C:\Windows\system32\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "WinHelp" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\360390_readme.txt"3⤵PID:2144
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
772B
MD5f6a2bb17bf99a4dab08f75504bf270b3
SHA1d42b9acaa08e19e1708e0e00a7961b8dd3219102
SHA25634d5153eb38ee664fc03fcb7de7a75a76c1162fa83110d34e6b64c29424ed6ed
SHA512037a713b6e8580adf6773992b29b75dcae8d0284dee228deddb41149d89aafefc9d8bf4374d8437d57f6a26afede42accb629988b5cd234430f53f5df2da0a96
-
Filesize
15KB
MD5d96f59d97099a6248989e828d766dd5b
SHA19322d296171970ce8a280a4c562f41b5f3689de0
SHA256e534769d416412d6ea8e91faf108bd8f52838e854145eab052483c37b4add1e3
SHA512562c52a4dab31d9fc8983823561d181ddd0d0999baf3cbe8841afd3919ae020df573f41bd58fe6ecd090d47a1a1d2bad6abd68955e329cd541974c12d4ceca8c