Overview

overview

10

Static

static

10

brain.exe

windows11-21h2-x64

10

Resubmissions

26/02/2025, 22:29

250226-2epdjsvygx 10

26/02/2025, 21:48

250226-1nyg5stzdt 10

21/02/2025, 20:45

250221-zjsweszqar 10

Analysis

  • max time kernel
    32s
  • max time network
    7s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250217-en
  • resource tags

    arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/02/2025, 20:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    brain.exe

  • Size

    147KB

  • MD5

    448f1796fe8de02194b21c0715e0a5f6

  • SHA1

    935c0b39837319fda571aa800b67d997b79c3198

  • SHA256

    eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12

  • SHA512

    0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831

  • SSDEEP

    3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4

Score
10/10
braincipherdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\sYMY1N6ah.README.txt

Family

braincipher

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: M8AL5cWJEU5CnMMPwCdt4x9NVn0ZY2uNtIgnKwkDJwdPbnanVROYFzGmgUCImexTGDmINYgSZXdlhM7D199lNMb294TGY2 Email to support: [email protected]
URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Signatures

  • Brain Cipher

    Ransomware family based on Lockbit that was first observed in June 2024.

    ransomwarebraincipher
  • Braincipher family
    braincipher
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\brain.exe
    "C:\Users\Admin\AppData\Local\Temp\brain.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\ProgramData\D1D7.tmp
      "C:\ProgramData\D1D7.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D1D7.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4792
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\sYMY1N6ah.README.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:4324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-501547156-4130638328-323075719-1000\CCCCCCCCCCC
    Filesize

    129B

    MD5

    ee458aac84404d005eaf66e4f105857c

    SHA1

    f2202ee22cdb2ab1d6d56512d3d1db7c0dd15d00

    SHA256

    ddade4277855dcf146602e29ceedd02ec26f381d8b907750b5ca36c323747001

    SHA512

    4c9994c82d4dcd65e6087c34eb91327e247aeabbde5de767cc9cac745aff3e4ee95afb95261515e0ffea73e08ca5c0e06978e7529a0c51fd5763acfcfce63430

    Download Submit

  • C:\ProgramData\D1D7.tmp
    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDD
    Filesize

    147KB

    MD5

    fe7e4b62a5129f2ee51175e0bfabce03

    SHA1

    2b000912a9fd853feed7828e1d52ff363d49894b

    SHA256

    1862aa0c6cb1c6eda2c7899286cd0390af403829afa80168aa45314211f3797d

    SHA512

    800fd98c9c8d0c2772c3507d2326fe0441d4b51d01b675a6da13bc6ddacba160e5baa0da567cad489975d03f3103d9ac6c31467a84d11d0f208fcce11438c294

    Download Submit

  • C:\sYMY1N6ah.README.txt
    Filesize

    1KB

    MD5

    deb2e0756d331362d57ad9fe408c4ff3

    SHA1

    870865aad7c7cccafbca0c1f50f7eecaedbd4bf1

    SHA256

    1ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c

    SHA512

    e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-501547156-4130638328-323075719-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    36f926ca433b3201ca97d962280deaeb

    SHA1

    b7abc753b25cf191487719fbd3412638b1b8ce9d

    SHA256

    2133cd50ab3c0a2610c75c72954bf0b13ab7f188b2b8c01e71cbe2591ab7f414

    SHA512

    16f37dc23f7888566666f107ab75d63ea461b26d2f78db896bd70d8d738cb19d0b5813be1644573d5e21da47ee905db396c2df63f0eef0e9b03e401783109279

    Download Submit

  • memory/4496-3570-0x000000007FE70000-0x000000007FE71000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4496-3573-0x000000007FDF0000-0x000000007FDF1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4496-3572-0x000000007FE50000-0x000000007FE51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4496-3571-0x00000000025E0000-0x00000000025F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4496-3602-0x000000007FE10000-0x000000007FE11000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4496-3603-0x000000007FE30000-0x000000007FE31000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5012-1-0x0000000002F40000-0x0000000002F50000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5012-3569-0x0000000002F40000-0x0000000002F50000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5012-0-0x0000000002F40000-0x0000000002F50000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5012-2-0x0000000002F40000-0x0000000002F50000-memory.dmp

    Filesize

    64KB

    Download