Overview

overview

10

Static

static

10

b2493a5801...49.exe

windows7-x64

10

b2493a5801...49.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2025, 12:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe

  • Size

    719KB

  • MD5

    8474039d83805eb7b447325c3a8d1ebb

  • SHA1

    a07d537f4253745a087709a9a07c449f84deed8d

  • SHA256

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

  • SHA512

    3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

  • SSDEEP

    12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6

Score
10/10
medusalockerneshtadefense_evasiondiscoverypersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Recovery\WindowsRE\Recovery_Instructions.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">812F6BBBA682A05A45D5971FCCB518E80D3038B23FAA8503B9E9DFA8768ADAB054BD59900FECFA857B50CFADC97FF2CB0BD23D36BCD40525ACBAAB651337481D<br>0C0710DD3814EAEF90C67797CBF1A78532E96FC3FC78D1136FA53FD9BE7230233D032CE2E5E2AC4F6E8932E635DBE9473D5B4D37A1E95B140BE7FFB5E840<br>10E59BE842014D98FDCF482B2C0B7AA6284C24B07A524BBCDDDD8204E8E62999AA17D46A4A48301078BFA93D82C939FE13957CAD440A643685CA8880B6A6<br>337F756ABE59075082B966C9F74FF036FE0F2BE78329020955AA2387C369A02D4D33D8026E16300B47A8C3C3EC4E7DE3AE3BFFD0899089C249EEE23E9E10<br>BA1679CC03A9FE10CB6A168521143CFAA1CECD6ECBC249A1EA3EDFADEB4835DEA326EBEC3AF38EB77DFD9E956835D08DE8F2617EF779B1450DD2D3389715<br>ACC1A867162CF57A4C25537319DF0C4EDA37A2AB48BCF017CF2CB88F7FB19D068073A1A4290F7A2772D46F0D3F669F7B8721CD7AD00E150D73CE2946859F<br>082ED658C77619C1099BA5949D885B1736A223FFF8334861203B5392523D5D9B6342659CD6463519345067DC5E3C8E1D6FD600A7E62C94C3869AE36697AE<br>A9B78AE9F9CF6EBC3EEF79B75B61067363D0799EDBA6CD26C0A3E85BA584C0D9FA9778A476F48F8A65770107615374F891A4BF81DA16E01DC2B2A324B6B5<br>FB42DA740F07B86D59E93F91D26E</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-LVE0W9w9i5j3EjZEYVgfwPpu43Xe7oQu</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected]</a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • Detect Neshta payload 9 IoCs
  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 2 IoCs
  • Medusalocker family
    medusalocker
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Renames multiple (144) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
    "C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1636
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:856
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3968
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3932
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6132
      • C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
        C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

    Download Submit

  • C:\Recovery\WindowsRE\Recovery_Instructions.html
    Filesize

    4KB

    MD5

    c1da6ebc7448641d53c1aa6c0d3d8709

    SHA1

    f140ec95ebcfbe8ee84b80c2ba3c49644b6a4a2c

    SHA256

    849223c9f1a55b40807db324fb580f243b741c7968ac52b18d1fc367ef9bd5ff

    SHA512

    294bf227f3ac0a90375ddf416c4040778fc40d71969b5c71836926dd076119c18e2be1bbfc33211b6c521c80c0e8a64b0a8cf9ff8fead1d5c5dbabb8eeac0a94

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
    Filesize

    678KB

    MD5

    5aa0a571567f8437556e9b00ae5a3532

    SHA1

    45377cb152832c9112db7909219fa87a6e760aae

    SHA256

    73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432

    SHA512

    d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
    Filesize

    8B

    MD5

    58e558ac4751e8d77ecbc24791b7c5a1

    SHA1

    a31173094483044a54225fe21a327ea3f15b8e16

    SHA256

    d081f13955a7ece2beba0bbe54aec204a755895dc1888df070cfc9b81f076925

    SHA512

    d103b2fbca98fe443f6d2a03358bb666f787e089c0a16d0743d1c121fc2df0218c03c781a6a32fb49c3bdcaa3dde61138ecddf7bc4baffb6b7759a2c6f122d46

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    719KB

    MD5

    8474039d83805eb7b447325c3a8d1ebb

    SHA1

    a07d537f4253745a087709a9a07c449f84deed8d

    SHA256

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

    SHA512

    3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

    Download Submit

  • C:\Users\Default\ntuser.dat.LOG2
    Filesize

    536B

    MD5

    c375c4a15782df5877da61e6cc023ef2

    SHA1

    30835f6824ccd951578eca8b674474e7e8bceedd

    SHA256

    669aea5161394119558ef00f0ff7600a2ea5652aa5b8270033189ed62c66b108

    SHA512

    ad1029a397a510f69b6ab82e8ff93ff42b39f1156c07bf50969f3ef65c368e55714610589ed711a891ce406dd42c95698cd8e4c55d6ae8e95ca600bd6c687377

    Download Submit

  • C:\Windows\svchost.com
    Filesize

    40KB

    MD5

    36fd5e09c417c767a952b4609d73a54b

    SHA1

    299399c5a2403080a5bf67fb46faec210025b36d

    SHA256

    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

    SHA512

    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

    Download Submit

  • memory/2248-595-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/3448-579-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/3448-583-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/3448-581-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/3448-580-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/6132-601-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download