Resubmissions
26/02/2025, 22:29
250226-2epdjsvygx1026/02/2025, 21:48
250226-1nyg5stzdt1021/02/2025, 20:45
250221-zjsweszqar10Analysis
- max time kernel
727s - max time network
696s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
26/02/2025, 22:29
General
- Target brain.exe
- Size 147KB
- Sample250226-2epdjsvygx
- SHA256 eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
Malware Config
Extracted
-
C:\sYMY1N6ah.README.txt
-
braincipher
- *** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: M8AL5cWJEU5CnMMPwCdt4x9NVn0ZY2uNtIgnKwkDJwdPbnanVROYFzGmgUCImexTGDmINYgSZXdlhM7D199lNMb294TGY2 Email to support: [email protected]
-
http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
Signatures
- Brain Cipher
Ransomware family based on Lockbit that was first observed in June 2024.
- Braincipher family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: RenamesItself 26 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 31 IoCs
- Suspicious use of SendNotifyMessage 28 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\brain.exe"C:\Users\Admin\AppData\Local\Temp\brain.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\D88D.tmp"C:\ProgramData\D88D.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D88D.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushEnable.mpa"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushEnable.mpa"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushEnable.mpa"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RequestUnprotect.mpa"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
AAAAAAAAAAA
D88D.tmp
f320adc4-3786-4397-9df7-d98fd563b504.down_data
EEEEEEEEE
ml.xspf
vlc-qt-interface.ini
vlc-qt-interface.ini.fe2872
vlcrc
sYMY1N6ah.README.txt
DDDDDDDDDDD
memory/2872-2899-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp
memory/2872-2900-0x00007FFB93CB0000-0x00007FFB93DBE000-memory.dmp
memory/2872-2897-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp
memory/2872-2898-0x00007FFBA8C40000-0x00007FFBA8C74000-memory.dmp
memory/3140-2860-0x00007FFBA0520000-0x00007FFBA0554000-memory.dmp
memory/3140-2846-0x00007FFB9F2E0000-0x00007FFB9F2F1000-memory.dmp
memory/3140-2862-0x00007FFB92F10000-0x00007FFB93FC0000-memory.dmp
memory/3140-2859-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp
memory/3140-2861-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp
memory/3140-2841-0x00007FFB92F10000-0x00007FFB93FC0000-memory.dmp
memory/3140-2830-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp
memory/3140-2843-0x00007FFBA00D0000-0x00007FFBA00F1000-memory.dmp
memory/3140-2842-0x00007FFB9B730000-0x00007FFB9B771000-memory.dmp
memory/3140-2844-0x00007FFBA0350000-0x00007FFBA0368000-memory.dmp
memory/3140-2836-0x00007FFBA45B0000-0x00007FFBA45C7000-memory.dmp
memory/3140-2832-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp
memory/3140-2837-0x00007FFBA4560000-0x00007FFBA4571000-memory.dmp
memory/3140-2835-0x00007FFBA4660000-0x00007FFBA4671000-memory.dmp
memory/3140-2840-0x00007FFB95210000-0x00007FFB9541B000-memory.dmp
memory/3140-2834-0x00007FFBA4D20000-0x00007FFBA4D37000-memory.dmp
memory/3140-2833-0x00007FFBA54D0000-0x00007FFBA54E8000-memory.dmp
memory/3140-2831-0x00007FFBA0520000-0x00007FFBA0554000-memory.dmp
memory/3140-2839-0x00007FFBA0370000-0x00007FFBA0381000-memory.dmp
memory/3140-2838-0x00007FFBA2BE0000-0x00007FFBA2BFD000-memory.dmp
memory/3140-2848-0x00007FFB92900000-0x00007FFB9295C000-memory.dmp
memory/3140-2847-0x00007FFB9F2C0000-0x00007FFB9F2D1000-memory.dmp
memory/3140-2849-0x000002422CE30000-0x000002422CFB0000-memory.dmp
memory/3140-2845-0x00007FFB9FDD0000-0x00007FFB9FDE1000-memory.dmp
memory/3400-2887-0x00007FFBA4660000-0x00007FFBA4671000-memory.dmp
memory/3400-2882-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp
memory/3400-2883-0x00007FFBA8C40000-0x00007FFBA8C74000-memory.dmp
memory/3400-2884-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp
memory/3400-2885-0x00007FFBA54D0000-0x00007FFBA54E8000-memory.dmp
memory/3400-2886-0x00007FFBA4D20000-0x00007FFBA4D37000-memory.dmp
memory/3588-2777-0x000000007FE40000-0x000000007FE41000-memory.dmp
memory/3588-2778-0x000000007FE20000-0x000000007FE21000-memory.dmp
memory/3588-2779-0x000000007FDC0000-0x000000007FDC1000-memory.dmp
memory/3588-2810-0x000000007FE00000-0x000000007FE01000-memory.dmp
memory/3588-2809-0x000000007FDE0000-0x000000007FDE1000-memory.dmp
memory/4852-2780-0x0000000001620000-0x0000000001630000-memory.dmp
memory/4852-2776-0x0000000001620000-0x0000000001630000-memory.dmp
memory/4852-1-0x0000000001620000-0x0000000001630000-memory.dmp
memory/4852-2771-0x0000000001620000-0x0000000001630000-memory.dmp
memory/4852-2-0x0000000001620000-0x0000000001630000-memory.dmp
memory/4852-0-0x0000000001620000-0x0000000001630000-memory.dmp
memory/4992-2820-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp
memory/4992-2821-0x00007FFBA0520000-0x00007FFBA0554000-memory.dmp
memory/4992-2822-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp
memory/4992-2829-0x00007FFBA4660000-0x00007FFBA4671000-memory.dmp
memory/4992-2828-0x00007FFBA4D20000-0x00007FFBA4D37000-memory.dmp
memory/4992-2827-0x00007FFBA54D0000-0x00007FFBA54E8000-memory.dmp