Overview

overview

10

Static

static

3

ENCRYPT_C_...RY.exe

windows7-x64

10

ENCRYPT_C_...RY.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2025 20:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ENCRYPT_C_VISIBLEENTRY.exe

  • Size

    391KB

  • MD5

    4be7c8cdc4eb344bc3bce1e9d2bf4b6d

  • SHA1

    5c18b5a920917420dfba267853769ce0e11ef57f

  • SHA256

    6aabcc25ae4ca7804b2f70fdf4b9fd17ca8cfd70bb0c9903a8d537570ebb9405

  • SHA512

    46492322b2392ab8ce9bde3f8ad62bd95e62de1d8c0a0c284ef58334a2e3e7a38ad193c2f69a0f6a5d769d12f6bc9fe815cb9699aa256dd474836c8d8bd7395c

  • SSDEEP

    12288:SUyh8ETAbg65kkZ7oZXu6PWHzXzroCvczjCo:3dDbgerajCo

Score
10/10
blackbastadiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files\instructions_read_me.txt

Family

blackbasta

Ransom Note
Hello! If you are reading this, it means we have encrypted your data and took your files. DO NOT PANIC! Yes, this is bad news, but we will have a good ones as well. YES, this is entirely fixable! Our name is BlackBasta Syndicate, and we are the largest, most advanced, and most prolific organized group currently existing. We are the ultimate cyber tradecraft with a credential record of taking down the most advanced, high-profile, and defended companies one can ever imagine. You can Google us later; what you need to know now is that we are business people just like you. We have your data and encrypted your files, but in less than an hour, we can put things back on track: if you pay for our recovery services, you get a decryptor, the data will be deleted from all of our systems and returned to you, and we will give you a security report explaining how we got you. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login: 461cccc9-8580-4474-845d-6f4c916b64cd This is a link to a secure chat. We will talk there. Inside that chat, we will share a second designated link that only your special team will be able to see. For now, think about the following. This incident hits your network and is stopping you from operating properly. The sooner you get back on track, the better it is. See you in the secure chat.
URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Signatures

  • Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Blackbasta family
    blackbasta
  • Renames multiple (9633) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ENCRYPT_C_VISIBLEENTRY.exe
    "C:\Users\Admin\AppData\Local\Temp\ENCRYPT_C_VISIBLEENTRY.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe c:\instructions_read_me.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Opens file in notepad (likely ransom note)
        PID:264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\instructions_read_me.txt
    Filesize

    1KB

    MD5

    83d5be091b05aaa39eee00429dbb0c8b

    SHA1

    c31ebdaf3d8522e9053ca12e04cc4af783c450ca

    SHA256

    72317b27324006c389c928d2575beb77c18b3f0a61343040dddc6f3c7edfa195

    SHA512

    c411d4266951553f9bbb9803b0e13334381eca18381ec5412e23ffed2c3a1b8c73f3fed6ca43e580b3cb9da94c6eeb6ec76cc12cfff546062fa490f0bd712285

    Download Submit

  • memory/1088-0-0x0000000000470000-0x00000000004B2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1088-2-0x0000000000530000-0x00000000005A4000-memory.dmp

    Filesize

    464KB

    Download

  • memory/1088-4-0x0000000000530000-0x00000000005A4000-memory.dmp

    Filesize

    464KB

    Download

  • memory/1088-3-0x0000000000530000-0x00000000005A4000-memory.dmp

    Filesize

    464KB

    Download

  • memory/1088-602-0x0000000000530000-0x00000000005A4000-memory.dmp

    Filesize

    464KB

    Download

  • memory/1088-21314-0x0000000000530000-0x00000000005A4000-memory.dmp

    Filesize

    464KB

    Download

  • memory/1088-21336-0x0000000000530000-0x00000000005A4000-memory.dmp

    Filesize

    464KB

    Download