Overview

overview

10

Static

static

10

BloodEagle...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-02-2025 11:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BloodEagle Ransomware Builder.exe

  • Size

    683KB

  • MD5

    bd74ac3a184b41087eaffe1c4e5575f1

  • SHA1

    dcf0cc5cf9d633f398bda7821bb04b89ac60870d

  • SHA256

    87675dc68eac28c09af5658389267f7160d34865aaa4d2abaf4f127432333bcc

  • SHA512

    bed0db9ed78e0459b151849b6c04ed626a664b6779fdce3b5ccdced5dc06c2eea208b08dc1cf153a6781587c45fba3d92a8f5a27952c58fcace27330a75d9526

  • SSDEEP

    3072:hL6xoPurnfsj7A0H7GMgXuD//bFLAkC3IGYWEyNakhm5Zt1HrTM/rFLjZkJ:8kj0aGMVFLQJPJUEFL2

Score
10/10
chaosdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Chaos family
    chaos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 7 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 56 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\BloodEagle Ransomware Builder.exe
    "C:\Users\Admin\AppData\Local\Temp\BloodEagle Ransomware Builder.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aw24lq0m\aw24lq0m.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4104
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1728.tmp" "c:\Users\Admin\Desktop\CSCF6C45FD940140DDB65D9489188BF948.TMP"
        3⤵
          PID:3284
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0M0ODhCRDktMzJDOS00RkRELTk0OEMtQjY4MEYwODQ4MzI2fSIgdXNlcmlkPSJ7ODg1QjQ3M0MtN0U4NS00NzJBLUFGQjktQUFCRTExOTJDRDRCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDc5NkY2RkYtNzA1QS00RjBBLUIxMDUtNTYxN0I3OEIwQTU1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI3IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODI0MDg4ODIyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:1496
    • C:\Users\Admin\Desktop\xgyh.exe
      "C:\Users\Admin\Desktop\xgyh.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        2⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3252
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2072
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:1812
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4772
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3512
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} bootstatuspolicy ignoreallfailures
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:3496
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} recoveryenabled no
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:1900
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:756
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:1540
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:296
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Drops startup file
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1904
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3068
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2036
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:2148
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:2256
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
          PID:3204

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Direct Volume Access

        1
        T1006

        Indicator Removal

        3
        T1070

        File Deletion

        3
        T1070.004

        Modify Registry

        1
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        4
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        4
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xgyh.exe.log
          Filesize

          660B

          MD5

          1c5e1d0ff3381486370760b0f2eb656b

          SHA1

          f9df6be8804ef611063f1ff277e323b1215372de

          SHA256

          f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a

          SHA512

          78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\RES1728.tmp
          Filesize

          1KB

          MD5

          7bd1d28bc055db6c574200ac77feec35

          SHA1

          388748b1e12a1bd24f5b3c88fc5bdddad84aee46

          SHA256

          b16dbbc849f8e1a9344d488b9aa3bf2e4c6da4432151fefc545f63ebe155fc18

          SHA512

          591363e55fbd1a62c54a81e6dfd76ee24c3720adba58fc7ec1a5bb9769e8f116a3422f6bc97b0618acf2a63c53f375413359f6655fc9c62d2db7c9fcf9406436

          Download Submit

        • C:\Users\Admin\AppData\Local\read_it.txt
          Filesize

          94B

          MD5

          c5de4ab2ad8772c15196bb351cbebe89

          SHA1

          a99ce461fb5caafdf4be50829a516d8df9cc02df

          SHA256

          c8a3abd91a5a783392150348a97e879153a5be2377cd6741c58ae79d3ff5f8e9

          SHA512

          546719e1ec368b5040f00e0965be871e168c18360b1416a40d33f68b3fcbcfabeabd4a9445fb2c5aa1ae577bbc6c5ab9789123229507901446d34c9ba9b7dd2c

          Download Submit

        • C:\Users\Admin\Desktop\DisableLock.css
          Filesize

          1B

          MD5

          d1457b72c3fb323a2671125aef3eab5d

          SHA1

          5bab61eb53176449e25c2c82f172b82cb13ffb9d

          SHA256

          8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

          SHA512

          ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

          Download Submit

        • C:\Users\Admin\Desktop\xgyh.exe
          Filesize

          26KB

          MD5

          6a04739098ee802e55031f1864e0c453

          SHA1

          93f896a21169ebce07b49cfce9ee7b3fbbbf7ba3

          SHA256

          db6def415b864b2cd72cc496faa2fe7a427ea62177506b44aaa25b90578c26a0

          SHA512

          bd8c18992f21664559db304f9570460a7370b5d34831964b113550a9e57d9e89248e386adfa25c3e1b8f9e2195597461714a62a929245d2792b1b810cd250226

          Download Submit

        • C:\Users\All Users\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
          Filesize

          597KB

          MD5

          2db63508bde08fd55d00079c742e5ba2

          SHA1

          9d94e19dc6fcd8acfd101651b9d4f225e7beadf8

          SHA256

          a68a3a6c4620d3ef92fe80cc0476b65cf3f5aa69400dfeba01475844dad3aaf9

          SHA512

          ebd8af6c2d6a1ba9011a96c89d7a52b31d41952ee3dc055ced5d567103ec8a69808379e557efa3dbd21faec9312f9511c7b5679d6aa1241bf851101165fb9598

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\aw24lq0m\aw24lq0m.0.cs
          Filesize

          38KB

          MD5

          eb22b3ffee321041b400d5bb2ab47b08

          SHA1

          c03cf79a3b4a2270462d77e0799a288b9c771b46

          SHA256

          d834994a4e42f88e2f97406b1d66dab7f558347be9dc8db5fa2b6088cb1b27d3

          SHA512

          dc4e714e4c91e1e2ca73e5232551cd1731a078338a3dea72f84586583189df7ade6f227b1df77c0dd30cf798400e6e3fa2e2d2bdee70437e2383f63e13ae068f

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\aw24lq0m\aw24lq0m.cmdline
          Filesize

          386B

          MD5

          c2248fd1c45ce9fbb889aa5e51b6d34e

          SHA1

          4c31ca2a9cf57c7e2c715a37bc0172d30bc9d8ef

          SHA256

          967462bf3407c8551d3f6a28b4c5f7c5d405d7730f5dac74d7ffd12e903043cf

          SHA512

          c9df599ea4580ed23df918cff03ded80334f4165479aed8d0d2d0df9af1cf835f2ea23a953ec7396bb87f6d8195a2f1c4fdb77f83bfca65eaf7e48e925b1a6f1

          Download Submit

        • \??\c:\Users\Admin\Desktop\CSCF6C45FD940140DDB65D9489188BF948.TMP
          Filesize

          1KB

          MD5

          349c19794dd1ac60dac1f5266694ad97

          SHA1

          f13b0cc1880a3676ba8dd12c86c979a0e347d5d4

          SHA256

          ab453f5a530b40079a95bd66e32c8f8c115c42122a9fce28a06d9d63bb522c1e

          SHA512

          d98914d30e6db51ddf91d4d4df2fd50ccd6dfdae5926db215d89990a5f036403aa2c74b209d8ad7c7a790efdd3a57a3e0f8a38df4793fb44a95a3ad9fe1ef28d

          Download Submit

        • memory/1904-42-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-38-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-39-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-40-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-41-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-43-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-37-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-31-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-32-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-33-0x0000020E75930000-0x0000020E75931000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1944-6-0x00007FFFE62F0000-0x00007FFFE6DB1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1944-0-0x00007FFFE62F3000-0x00007FFFE62F5000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1944-7-0x00007FFFE62F0000-0x00007FFFE6DB1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1944-8-0x00007FFFE62F0000-0x00007FFFE6DB1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1944-9-0x00007FFFE62F0000-0x00007FFFE6DB1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1944-10-0x00007FFFE62F0000-0x00007FFFE6DB1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1944-5-0x00007FFFE62F3000-0x00007FFFE62F5000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1944-3-0x00007FFFE62F0000-0x00007FFFE6DB1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1944-2-0x00007FFFE62F0000-0x00007FFFE6DB1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1944-1-0x0000000000FF0000-0x00000000010A0000-memory.dmp

          Filesize

          704KB

          Download

        • memory/1944-1204-0x00007FFFE62F0000-0x00007FFFE6DB1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4996-30-0x00000000001F0000-0x00000000001FC000-memory.dmp

          Filesize

          48KB

          Download