Overview

overview

10

Static

static

1

Urget Cont...on.zip

windows7-x64

1

Urget Cont...on.zip

windows10-2004-x64

1

Urget Cont...on.eml

windows7-x64

5

Urget Cont...on.eml

windows10-2004-x64

3

Urgent Con...df.exe

windows7-x64

10

Urgent Con...df.exe

windows10-2004-x64

10

email-html-2.txt

windows7-x64

1

email-html-2.txt

windows10-2004-x64

1

email-plain-1.txt

windows7-x64

1

email-plain-1.txt

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Urget Contract Action.zip

  • Size

    424KB

  • Sample

    250109-rnsr8a1rhx

  • MD5

    607104ec5c797bd46a0a6bc76bfac512

  • SHA1

    d6c5562c2c63c5d164cf09ab8c829cf8d4ed1581

  • SHA256

    137cfbc6611add95e7dd00247098efc9aa4b16771d62c20a5d149f2181da6d6c

  • SHA512

    0fdd49b6939bcf281a2cbcd50ab53989864a498e37dbf0d55ebc8f2e1ec3ee14c41ec52c8828d99f1ca612d95a53f22d2c76c0d8aa219740f00a736d9573b0b2

  • SSDEEP

    12288:ZUpblYhNXCaq0DXHyLoo4Re+Bo3KhiJeHMgV+awgp:ZUpblYDXZDXKFJ+BOKSi+5G

Score
10/10
badrabbitmimikatzdiscoveryransomware

Malware Config

Targets

    • Target

      Urget Contract Action.zip

    • Size

      424KB

    • MD5

      607104ec5c797bd46a0a6bc76bfac512

    • SHA1

      d6c5562c2c63c5d164cf09ab8c829cf8d4ed1581

    • SHA256

      137cfbc6611add95e7dd00247098efc9aa4b16771d62c20a5d149f2181da6d6c

    • SHA512

      0fdd49b6939bcf281a2cbcd50ab53989864a498e37dbf0d55ebc8f2e1ec3ee14c41ec52c8828d99f1ca612d95a53f22d2c76c0d8aa219740f00a736d9573b0b2

    • SSDEEP

      12288:ZUpblYhNXCaq0DXHyLoo4Re+Bo3KhiJeHMgV+awgp:ZUpblYDXZDXKFJ+BOKSi+5G

    Score
    1/10
    behavioral1behavioral2

    • Target

      Urget Contract Action.eml

    • Size

      604KB

    • MD5

      048c02e929690bcb0a537d08e71f6b50

    • SHA1

      e35f34239708f1d2ac63dc88366dcb3686d0d1eb

    • SHA256

      c5fe32e5de97a1c0ff01c7bcbc99d7086a485b6df9ac7cdb37e906f6e1d01da3

    • SHA512

      bd942387e85c4981cba4617089728958e7bf163efb73ee5624e3f5e409552426a3ee67d0900bca18dc089552d5c855ca99dbf5115f4293eb5162e346a68fcaa9

    • SSDEEP

      12288:G35ETPjPNu1JoTIIu4Q3H3KNgrYq/6lm2pNRs/P7IunP9m4QSmWveSI:PPDkreIItQqev/Qmofs/TdnPvPpeB

    Score
    5/10
    discovery

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      Urgent Contract Action.pdf.exe

    • Size

      431KB

    • MD5

      fbbdc39af1139aebba4da004475e8839

    • SHA1

      de5c8d858e6e41da715dca1c019df0bfb92d32c0

    • SHA256

      630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

    • SHA512

      74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

    • SSDEEP

      12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

    Score
    10/10
    badrabbitmimikatzdiscoveryransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Badrabbit family

      badrabbit

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral5behavioral6

    • Target

      email-html-2.txt

    • Size

      4KB

    • MD5

      54e28bc9a318a7c34ba36b040ae22f7c

    • SHA1

      8e1b616b2d55f1bf7db468863c0ac9b875f8e883

    • SHA256

      2843f5721f82a52a0de9adb17b4a39ead22356711065a7deff15b0d7c5dd3523

    • SHA512

      286024e1d4f89c21513437ec6ad9115dd6cf45e2de7b7a49ae27f687498a439f2bff2d912b15f9d1efb868144fd63fa7214dce7f277d5e260ac770f8bf7b58a3

    • SSDEEP

      96:VAeznkXKWFEwchCH5dmklZoey1c7QDPMPpPc:yQULEfe5UkDfQIhk

    Score
    1/10
    behavioral7behavioral8

    • Target

      email-plain-1.txt

    • Size

      3KB

    • MD5

      d12a8819f44c12586fad964d4d15de58

    • SHA1

      4f2a7b1fa287d412b250762e70547e5afaba03d1

    • SHA256

      e58a6b8c4042916b7c7299c9ae49bb9f2ce281e1cd62abb6c6e82938bc97dd7d

    • SHA512

      3dcaac6ca5f8291fbb06a71424f270899866ef86f83daa3a3d8959a0714e394ef4a76831a9eca971c293983b2eb43d2566d9e1ec272fddcb48630dad048acbaa

    Score
    1/10
    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Tasks