Overview

overview

10

Static

static

10

a756abab3a...b2.exe

windows7-x64

10

a756abab3a...b2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2025, 06:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2.exe

  • Size

    149KB

  • MD5

    7f040e7be2a5085703fe895d0625c925

  • SHA1

    0be799d98e6719bfe594fb502e012e173bc0bfea

  • SHA256

    a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2

  • SHA512

    746b5b8b1c62e8e500e5d91fabb8c7a9ddae5a47440eb04babfc8a7a39dca89f51c2d846b5bc1993217c1dc7f8f6f9b2aa29b42b6a59c3fa5357cf48f020cfd1

  • SSDEEP

    3072:+6glyuxE4GsUPnliByocWep9/PCTgLbvI1:+6gDBGpvEByocWebPAgLDI1

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\u3faqlCea.README.txt

Ransom Note
~~~ To Dear Rota Trasporti Team ~~~ >>>> Your data are stolen and encrypted We encrypted and stole your documents, emails, and databases. We have viewed your email data in MailStore and can find all your customer information and customer needs. And we found some companies in Italy that do the same business as yours, including but not limited to the following companies: 1. https://www.girteka.eu 2. https://www.teleroute.com 3. https://www.nieddu.it 4. https://www.robustellitrasporti.it 5. https://www.matricardispa.com 6. https://www.monguzzitrasporti.it 7. https://logisica.com 8. https://itlmgroup.com 9. https://www.sogedim.it 10. https://www.dgftrans.it If you do not contact us and accept the negotiation, we will sending download links of your data to both your customers and competitors for free. And will report the information of users you do not care about at https://www.garanteprivacy.it. >>>> What are the benefits of working with us? Network security is important, and you can consider this experience as a paid security test, we will help you point out your network security risks. Our ransom is much lower than other ransomware, it is even lower than the price you pay for a security company to do security testing. This amount of money is nothing compared to the fines of privacy protection laws and customer trust. >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need to contact us with your personal DECRYPTION ID: 055CF6F4EC4B6BE3998D55CB7BC03437 >>>> To contact us: Way1: Use signal (suggestion) 1. Download Getsesion https://signal.org/download/ 2. Add friend username: aleen.29 Way2: Use session (suggestion) 1. Download Getsesion https://getsession.org/download 2. Add friend my id: 0549caf3190e21ab3fca15d5327aff676e9457fb96106964ecd394b69674abe301 Way3: Use email Email address [email protected] To ensure contact, it is best send message use three ways at the same time >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

https://www.girteka.eu

https://www.teleroute.com

https://www.nieddu.it

https://www.robustellitrasporti.it

https://www.matricardispa.com

https://www.monguzzitrasporti.it

https://logisica.com

https://itlmgroup.com

https://www.sogedim.it

https://www.dgftrans.it

https://www.garanteprivacy.it

https://signal.org/download/

https://getsession.org/download

Signatures

  • Renames multiple (7717) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2.exe
    "C:\Users\Admin\AppData\Local\Temp\a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\ProgramData\2B16.tmp
      "C:\ProgramData\2B16.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2B16.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2344
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:2440

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-677481364-2238709445-1347953534-1000\AAAAAAAAAAA
      Filesize

      129B

      MD5

      cb3d3b18053807a9d971add78fe8ef64

      SHA1

      6d465e6a8bf7b02ec7e92342e3b2f170070684c1

      SHA256

      7a7425699ee3fadd79fc7558b5b2edbcc89c0c6ae1cc3771bd5d0ce7826c3eae

      SHA512

      4e7cb8f3157f8c138e8c094424959a661857b240b3af6f46017395c31ee3faa46358d1a62bb4ae0c700491a6a7c256a663fa3465f456d8e80c8cc366f3710a19

      Download Submit

    • C:\ProgramData\2B16.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      149KB

      MD5

      39578dc13bea5ff326d23f798f840a78

      SHA1

      9a80d46f1f240740a3d0928fa47a7ee2f91914a9

      SHA256

      115de8903b08a963b4b93c1a2b0eb511bf88029327da3305c80b5365b94c2d9e

      SHA512

      e60ba23a6afb7bed326e2470fa14f2fe4818f81dff564d5cc4ee6896ab96c5be45392a7aa29b78cab3518bab49cd1c3eef8761ed5cd579742d0e7080277649a4

      Download Submit

    • C:\u3faqlCea.README.txt
      Filesize

      2KB

      MD5

      ae689f6cdf3b2b93c5e6177802ea507d

      SHA1

      1c0e9c1036b1b9f1ae5516ac6d609ab6fe661cde

      SHA256

      c2fdf95d39eea38775d7fee8a365fad3c2e43e5560929756ad4028c38d34d6db

      SHA512

      75e626975158a80f8a08ef788614fdade0593b41a2f192d1ee505a4682bcf4e39f31489da4d4e0b7e510627262712b82fce3af1e38c3347970ee93043faa983c

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-677481364-2238709445-1347953534-1000\CCCCCCCCCCC
      Filesize

      129B

      MD5

      af232c9410634f0c01483d563aa748ed

      SHA1

      76d23df1fc665056e2b202521e55f00b9db3287e

      SHA256

      c879109a47cb8e80633abb2518adf76903c199a852ecabe4bcf9a913fff3bcd7

      SHA512

      4e8346eb0697e48ffdd56dd5a7beb5ba19c96fcc06513d3898197e15410d92487303c777bc67d4e93370546d1b6307a4bb5a2e4403277eac4f8616a9928d73b1

      Download Submit

    • memory/2160-0-0x0000000000B10000-0x0000000000B50000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2816-11556-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2816-11554-0x0000000000401000-0x0000000000404000-memory.dmp

      Filesize

      12KB

      Download