Overview

overview

10

Static

static

10

a756abab3a...b2.exe

windows7-x64

10

a756abab3a...b2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    97s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2025, 05:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2.exe

  • Size

    149KB

  • MD5

    7f040e7be2a5085703fe895d0625c925

  • SHA1

    0be799d98e6719bfe594fb502e012e173bc0bfea

  • SHA256

    a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2

  • SHA512

    746b5b8b1c62e8e500e5d91fabb8c7a9ddae5a47440eb04babfc8a7a39dca89f51c2d846b5bc1993217c1dc7f8f6f9b2aa29b42b6a59c3fa5357cf48f020cfd1

  • SSDEEP

    3072:+6glyuxE4GsUPnliByocWep9/PCTgLbvI1:+6gDBGpvEByocWebPAgLDI1

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\u3faqlCea.README.txt

Ransom Note
~~~ To Dear Rota Trasporti Team ~~~ >>>> Your data are stolen and encrypted We encrypted and stole your documents, emails, and databases. We have viewed your email data in MailStore and can find all your customer information and customer needs. And we found some companies in Italy that do the same business as yours, including but not limited to the following companies: 1. https://www.girteka.eu 2. https://www.teleroute.com 3. https://www.nieddu.it 4. https://www.robustellitrasporti.it 5. https://www.matricardispa.com 6. https://www.monguzzitrasporti.it 7. https://logisica.com 8. https://itlmgroup.com 9. https://www.sogedim.it 10. https://www.dgftrans.it If you do not contact us and accept the negotiation, we will sending download links of your data to both your customers and competitors for free. And will report the information of users you do not care about at https://www.garanteprivacy.it. >>>> What are the benefits of working with us? Network security is important, and you can consider this experience as a paid security test, we will help you point out your network security risks. Our ransom is much lower than other ransomware, it is even lower than the price you pay for a security company to do security testing. This amount of money is nothing compared to the fines of privacy protection laws and customer trust. >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need to contact us with your personal DECRYPTION ID: 055CF6F4EC4B6BE3C224B07653F800FD >>>> To contact us: Way1: Use signal (suggestion) 1. Download Getsesion https://signal.org/download/ 2. Add friend username: aleen.29 Way2: Use session (suggestion) 1. Download Getsesion https://getsession.org/download 2. Add friend my id: 0549caf3190e21ab3fca15d5327aff676e9457fb96106964ecd394b69674abe301 Way3: Use email Email address [email protected] To ensure contact, it is best send message use three ways at the same time >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

https://www.girteka.eu

https://www.teleroute.com

https://www.nieddu.it

https://www.robustellitrasporti.it

https://www.matricardispa.com

https://www.monguzzitrasporti.it

https://logisica.com

https://itlmgroup.com

https://www.sogedim.it

https://www.dgftrans.it

https://www.garanteprivacy.it

https://signal.org/download/

https://getsession.org/download

Signatures

  • Renames multiple (7707) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Opens file in notepad (likely ransom note) 3 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2.exe
    "C:\Users\Admin\AppData\Local\Temp\a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\ProgramData\9E71.tmp
      "C:\ProgramData\9E71.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2264
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9E71.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2668
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\u3faqlCea.README.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:2768
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\u3faqlCea.README.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1708
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\u3faqlCea.README.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1704
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x150
    1⤵
      PID:1496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini
      Filesize

      129B

      MD5

      84c9861e727f610f9f1fb387368e6d11

      SHA1

      a35b92ca64bec91b35bc18da8da4fcb7621a7892

      SHA256

      f3f2eff1013ef272caa81f7f50a085a4701534493d030e0f8ef17174dcfb2dee

      SHA512

      b3983e4076dd774ffea6431f6b9c7daf31d4c0e4949f08dfc6d9ffa291da29f8fb5b74c375e834ceb30ca84bae34f3215731a1d121aa9008d8ee8636a4c1aed4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      149KB

      MD5

      430967b04c788e7eccc899fca8a6ad93

      SHA1

      22bcd186cd7377a9564a46d9d266667ea83c7e10

      SHA256

      958c2e9218ff24583ab14b27c683e62bdeb2f008707ac65b4f96f4cea38b6f5e

      SHA512

      a3869e07f53d4d850f63c1c6bd196b188ff842cbce9ab45bb9d87fffc1dcd6a2ee985f6dd0e4aa393f1b27a8c6480b286f39743c0ca82ac9bcf8329e38c8a850

      Download Submit

    • C:\u3faqlCea.README.txt
      Filesize

      2KB

      MD5

      36b02be7c8ff304c83d19ab58e0fcbb1

      SHA1

      14236fa167cd1059653f90254abfcf90e58d41cd

      SHA256

      e5f2e318aecdda1adf2e5b6133a25f30c83d51ee2ebc64711ec0944c41f44d29

      SHA512

      1895ae4e8da59e5b15496baa08898aabb2054b94e7b8938cd25f1f572fd1b2f1d09a6f99803a9af5c21e756939dd8feaa5580cf13b5d68f3de3ec8733ff5e262

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      485b47e04e3cadd5b90a1cf7b04f4bff

      SHA1

      3fdf0cf4fc57d67edee1e27c4e15c447d55841b3

      SHA256

      f2ddef1c0679347f1645889adb0aeef9a4e23a94f5a394f314af54580eb787d1

      SHA512

      9713938d1c2a54e896f9fa1efe1deb2a74ac7915fa9e82236272e19a61512cbe083e04f52349ed36aeeddc3059d3b0742a02d862830a21a4ced61c2d0963df5d

      Download Submit

    • \ProgramData\9E71.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/2608-1-0x0000000000250000-0x0000000000290000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2608-0-0x0000000000250000-0x0000000000290000-memory.dmp

      Filesize

      256KB

      Download