Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 12:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bebd409c8fae76c16040bcd69eed914520d3660ab2da057955e0fe6bef65bda1.bin.dll
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
bebd409c8fae76c16040bcd69eed914520d3660ab2da057955e0fe6bef65bda1.bin.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
bebd409c8fae76c16040bcd69eed914520d3660ab2da057955e0fe6bef65bda1.bin.dll
-
Size
1023KB
-
MD5
d231f7e053b711e99a40c1070992064f
-
SHA1
2a59f88f51fbe966382e2b82b22bdd6981240cb7
-
SHA256
bebd409c8fae76c16040bcd69eed914520d3660ab2da057955e0fe6bef65bda1
-
SHA512
d4778c696c87ad918e798413bf4ab535cbed6ffaf411635b3ee86b8be48e3fc1c35ae78f1514ce015ea56527cccd679a1cdaa2498514891f16b045e022fb3c7d
-
SSDEEP
12288:XlouFyOk1C+SWYgeWYg955/155/sxw5USG2eaumYIhg8/X1lBYK4o1TpzkBmbzyu:XlouFyOkY+lYKDyKIRQboJXhKTnVrf
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\instructions_read_me.txt
Family
blackbasta
Ransom Note
ATTENTION!
Your network has been breached and all data was encrypted. Please contact us at:
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Login ID: 5e80b250-815a-4062-8ac0-3ef4881feb08
*!* To access .onion websites download and install Tor Browser at:
https://www.torproject.org/ (Tor Browser is not related to us)
*!* To restore all your PCs and get your network working again, follow these instructions:
- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.
Please follow these simple rules to avoid data corruption:
- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption.
- Do not hire a recovery company. They can't decrypt without the key.
They also don't care about your business. They believe that they are
good negotiators, but it is not. They usually fail. So speak for yourself.
Waiting you in a chat.
URLs
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Signatures
-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Blackbasta family
-
Renames multiple (9721) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI rundll32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll rundll32.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01548_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml rundll32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_dot.png rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Verve.eftx rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp rundll32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_settings.png rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl.css rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png rundll32.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TAIL.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ClassicPhotoAlbum.potx rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7en.kic rundll32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png rundll32.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF rundll32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js rundll32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png rundll32.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml rundll32.exe File created C:\Program Files (x86)\Windows NT\TableTextService\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01607U.BMP rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\CT_ROOTS.XML rundll32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_cloudy.png rundll32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png rundll32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00397_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099167.JPG rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIconMask.bmp rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\CsiSoap.dll rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152704.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBRV.XML rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSMMS.CFG rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty.png rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00760L.GIF rundll32.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png rundll32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter.png rundll32.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.2bcqxjztt\DefaultIcon rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.2bcqxjztt rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.2bcqxjztt\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2440 notepad.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1900 wrote to memory of 1788 1900 rundll32.exe 33 PID 1900 wrote to memory of 1788 1900 rundll32.exe 33 PID 1900 wrote to memory of 1788 1900 rundll32.exe 33 PID 1788 wrote to memory of 2440 1788 cmd.exe 35 PID 1788 wrote to memory of 2440 1788 cmd.exe 35 PID 1788 wrote to memory of 2440 1788 cmd.exe 35
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bebd409c8fae76c16040bcd69eed914520d3660ab2da057955e0fe6bef65bda1.bin.dll,#11⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\system32\cmd.execmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt2⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\system32\notepad.exenotepad.exe c:\instructions_read_me.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50183004b53b0e8e81c0e2a177e7387a5
SHA12b5e4d8a4e2f84747331698f03533b5ce0e5e92a
SHA25677d2e21055427e33d3cc39d22d75d6744ae44a69057d75430703797309eb655c
SHA5121d28dbd5424560be1f7a6f6a9d703597b829c9de7af34c4a90efa70c32955af3cc46619819ef2fd34b9e1cc83cce1df179b42eae1c8f2bfb1d3ff8400131ff3c