cerber | a58b1f94ba24a2d7f06c2b7a9840243c4e1b75b1b580cf1ce4c5d9af69cedc85

Analysis

max time kernel
21s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tXauTiJr.exe
Size

521KB
MD5

464c348f1bdf66a75c6b0d51256e916c
SHA1

fa7f683e451ab0a0c6c18a4dde7b9bbdde72ff27
SHA256

a58b1f94ba24a2d7f06c2b7a9840243c4e1b75b1b580cf1ce4c5d9af69cedc85
SHA512

cb07284fd3d33eef29f761fd0d044a9143b9e934eff49a625290c4da23580c1b0bb1f4cd9d5e574c698fbf791d13aa476be2a550baebb4f925ef019015710233
SSDEEP

6144:8a/Z+6VHFnEXbw2Y3h3NWqU/xdwpN8T4LUEDW9VXnHFudT7coWspLaIZ1ZT:8a/h8w2UNiX0gEOpnHFutV5n3

Score

10^/10

cerber defense_evasion ransomware

Malware Config

Signatures

Cerber 3 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	pid	Process
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		AMIDEWINx64.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		AMIDEWINx64.exe
		2612	taskkill.exe

Cerber family
cerber

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	tXauTiJr.exe

Executes dropped EXE 2 IoCs

pid	Process
2420	AMIDEWINx64.exe
948	AMIDEWINx64.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3408	taskkill.exe
2612	taskkill.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	3408	taskkill.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2176	2436	tXauTiJr.exe	97
PID 2436 wrote to memory of 2176	2436	tXauTiJr.exe	97
PID 2436 wrote to memory of 3904	2436	tXauTiJr.exe	98
PID 2436 wrote to memory of 3904	2436	tXauTiJr.exe	98
PID 2436 wrote to memory of 3064	2436	tXauTiJr.exe	100
PID 2436 wrote to memory of 3064	2436	tXauTiJr.exe	100
PID 2436 wrote to memory of 2852	2436	tXauTiJr.exe	101
PID 2436 wrote to memory of 2852	2436	tXauTiJr.exe	101
PID 2436 wrote to memory of 5032	2436	tXauTiJr.exe	104
PID 2436 wrote to memory of 5032	2436	tXauTiJr.exe	104
PID 5032 wrote to memory of 2612	5032	cmd.exe	106
PID 5032 wrote to memory of 2612	5032	cmd.exe	106
PID 2436 wrote to memory of 3948	2436	tXauTiJr.exe	107
PID 2436 wrote to memory of 3948	2436	tXauTiJr.exe	107
PID 3948 wrote to memory of 2420	3948	cmd.exe	109
PID 3948 wrote to memory of 2420	3948	cmd.exe	109
PID 2436 wrote to memory of 5460	2436	tXauTiJr.exe	110
PID 2436 wrote to memory of 5460	2436	tXauTiJr.exe	110
PID 5460 wrote to memory of 948	5460	cmd.exe	112
PID 5460 wrote to memory of 948	5460	cmd.exe	112
PID 2436 wrote to memory of 4348	2436	tXauTiJr.exe	113
PID 2436 wrote to memory of 4348	2436	tXauTiJr.exe	113
PID 4348 wrote to memory of 3408	4348	cmd.exe	115
PID 4348 wrote to memory of 3408	4348	cmd.exe	115
PID 2436 wrote to memory of 5924	2436	tXauTiJr.exe	117
PID 2436 wrote to memory of 5924	2436	tXauTiJr.exe	117
PID 2436 wrote to memory of 5440	2436	tXauTiJr.exe	119
PID 2436 wrote to memory of 5440	2436	tXauTiJr.exe	119
PID 2436 wrote to memory of 3496	2436	tXauTiJr.exe	121
PID 2436 wrote to memory of 3496	2436	tXauTiJr.exe	121
PID 2436 wrote to memory of 4412	2436	tXauTiJr.exe	123
PID 2436 wrote to memory of 4412	2436	tXauTiJr.exe	123

C:\Users\Admin\AppData\Local\Temp\tXauTiJr.exe
"C:\Users\Admin\AppData\Local\Temp\tXauTiJr.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM WmiPrvSE.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS %RANDOM%%RANDOM%%RANDOM%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 27986273959412
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:2420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV %RANDOM%%RANDOM%%RANDOM%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 27986273959412
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM WmiPrvSE.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys
  2⤵
  PID:5924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys
  2⤵
  PID:5440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
  2⤵
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe

Filesize
452KB

MD5
c4d09d3b3516550ad2ded3b09e28c10c

SHA1
7a5e77bb9ba74cf57cb1d119325b0b7f64199824

SHA256
66433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3

SHA512
2e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2

Download Submit
C:\ProgramData\Microsoft\Windows\amifldrv64.sys

Filesize
18KB

MD5
785045f8b25cd2e937ddc6b09debe01a

SHA1
029c678674f482ababe8bbfdb93152392457109d

SHA256
37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

SHA512
40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

Download Submit