blackbasta | 38a5659c98ca7353b656e3542ec336a1e7ecab71febd35491344aca304275a0e

Analysis

max time kernel
7s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38a5659c98ca7353b656e3542ec336a1e7ecab71febd35491344aca304275a0e.bin.dll
Size

827KB
MD5

5b46d0066316816969848f1f04632ca2
SHA1

1aea30bf9e320d0a75e9b4e059eada88319b2b59
SHA256

38a5659c98ca7353b656e3542ec336a1e7ecab71febd35491344aca304275a0e
SHA512

e37c0e7332202b3811e0ed476309206ed1812363ea775cbd30d2f4e4400a37b56d0d4d6aeb0c1fc6b1ddbe23a50a111f01c3c9498395a6f747c33cd06c3599af
SSDEEP

24576:N9ihT/zGeEfg/g0bmSZq1Fv7L4YiED8h:EGeEfgkSZq1FDkYiEgh

Score

10^/10

blackbasta discovery ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 797393f4-70a6-4638-818f-f6e2f15f8d5e *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Signatures

Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta
Blackbasta family
blackbasta
Renames multiple (295) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\cancelled.slk	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	rundll32.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	rundll32.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\sqmapi.dll	rundll32.exe
File opened for modification	C:\Program Files\Internet Explorer\images\bing.ico	rundll32.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	rundll32.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\RestartApprove.mhtml	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\resources.pri	rundll32.exe
File created	C:\Program Files\7-Zip\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\WMPMediaSharing.dll	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png	rundll32.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\UninstallTest.vsdm	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui	rundll32.exe
File created	C:\Program Files\Internet Explorer\ja-JP\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AriaWrapper.winmd	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\platform.ini	rundll32.exe
File opened for modification	C:\Program Files\Windows Portable Devices\sqmapi.dll	rundll32.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	rundll32.exe
File opened for modification	C:\Program Files\SuspendCheckpoint.rtf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\ThinAppXManifest.xml	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf	rundll32.exe
File created	C:\Program Files\Windows Media Player\it-IT\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\Internet Explorer\sqmapi.dll	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\uninstall.log	rundll32.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui	rundll32.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui	rundll32.exe
File created	C:\Program Files\instructions_read_me.txt	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.ini	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	rundll32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\axvlc.dll	rundll32.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\clrcompression.dll	rundll32.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\instructions_read_me.txt	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.6hb9bgo67\DefaultIcon	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.6hb9bgo67	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.6hb9bgo67\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico"	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3920	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2340	2044	rundll32.exe	84
PID 2044 wrote to memory of 2340	2044	rundll32.exe	84
PID 2044 wrote to memory of 2340	2044	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38a5659c98ca7353b656e3542ec336a1e7ecab71febd35491344aca304275a0e.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38a5659c98ca7353b656e3542ec336a1e7ecab71febd35491344aca304275a0e.bin.dll,#1
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2340

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\instructions_read_me.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\instructions_read_me.txt

Filesize
1KB

MD5
342c19c71aa6304a5610255144cf0a0c

SHA1
5a0b574c4f1f0996978d65a1ead197e1301163b2

SHA256
a67de139250e2435c985b7214d10f38429d97b93ccf61f01cf93061c9178a9a0

SHA512
13fd6c2de9e1b8fce83033f9f8a360f702de91ed5cbd11af41c59c22b9ed7b88e83a7632bb8d313ce056a5559df21f8ad79d7de0c74a5f619f02c237af5077a7

Download Submit