Analysis

  • max time kernel
    103s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2025, 06:50

General

  • Target

    6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417.exe

  • Size

    147KB

  • MD5

    9c5698924d4d1881efaf88651a304cb3

  • SHA1

    c60a0b99729eb6d95c2d9f8b76b9714411a3a751

  • SHA256

    6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417

  • SHA512

    1e9cc0d7c831a496e3dbcc56f2d5d477e7a7546c2f223b0278fedfa10fc1bebb0412fd5d81ac02a77aa503ddc99dea1d59d9120d076ae7a0f5137c9260a64eea

  • SSDEEP

    3072:+6glyuxE4GsUPnliByocWepMT0CY2gbP39m3Lpdp:+6gDBGpvEByocWeAYTbPN8p

Malware Config

Extracted

Path

C:\flzQgniJJ.README.txt

Family

braincipher

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: uYrTA6hpRFsWQR0nqlFk5WK8S+zUIHNd9T3L6aykdR27ztPJwC3xHOsdSBkZhmr+yKcnVLCct0ffjVRy5yvFQydzhzQWJR Email to support: [email protected]
URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Signatures

  • Brain Cipher

    Ransomware family based on Lockbit that was first observed in June 2024.

  • Braincipher family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417.exe
    "C:\Users\Admin\AppData\Local\Temp\6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5124
    • C:\ProgramData\A4AC.tmp
      "C:\ProgramData\A4AC.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3284
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A4AC.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4160

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2645532622-3298555945-705856666-1000\WWWWWWWWWWW

    Filesize

    129B

    MD5

    6f73ac7100e6aedaede583949f93266f

    SHA1

    0a56410fda66e8226359ec7b8eede029e53547a3

    SHA256

    a093e168eb34a4ccbdfa452c0b0b4dfd484447845aef68b6a97e378f12e20b0d

    SHA512

    5698f2301a4032a1b78fc9e30ae5a2edcc80bb93430e52403aa8e7166006fcd4dcded46730ebac465034c7f77fd32bbc2db3fe122834b65bdb5c6cb7d58546d5

  • C:\ProgramData\A4AC.tmp

    Filesize

    14KB

    MD5

    294e9f64cb1642dd89229fff0592856b

    SHA1

    97b148c27f3da29ba7b18d6aee8a0db9102f47c9

    SHA256

    917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

    SHA512

    b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

  • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

    Filesize

    147KB

    MD5

    51d04cad2d4d2342c609be20bfaf3d01

    SHA1

    d85e22dec1bd5e9a6c09562f4ed889680945fd18

    SHA256

    dd160351a0cccbbb42c006af3e5626982092e36728aadac10425e8d9dec91ca0

    SHA512

    c81913a216711c962e44b25daee81b00cc1421c69d3011d61e3b8c683fd610c30cd60071dfc63cb481e7d1f9559dce244268d4fe90e71277f048ecb1676cd769

  • C:\flzQgniJJ.README.txt

    Filesize

    1KB

    MD5

    3bebb5494e1c3d4753ce92a479e7eda5

    SHA1

    243685d0515d19210e4e2f354d367be6212e98ff

    SHA256

    13d69c85aeb5beab58caefaa2cdc257d668f568103a5cebbd98038b3b66b66bd

    SHA512

    0e31e7bf96fbd6bb91fbe96e59acf96dd0fef5e9db9e93e924afd17fe1066c04b0d9bf9e2d60c335db4f0347107a63d92dfc9ba9b166d2e3151e5440232f63da

  • F:\$RECYCLE.BIN\S-1-5-21-2645532622-3298555945-705856666-1000\DDDDDDDDDDD

    Filesize

    129B

    MD5

    2214c55ead3fb39f0c6685ca69e8fe6e

    SHA1

    ce0b8439e653dd31557238a980a5e93bf156e389

    SHA256

    95cf3bd02307b94af7eb13bf0b1b54d8dce26956ab12d6b7bb1c224b63c50cf9

    SHA512

    9c70eb746732fe27a4282f431071fe37fdf1e6cb5650ffb5144e072d482b736d1983cd86ff70c8dca82aab512b631b36d960cf453c88e3b413d9569ad694761d

  • memory/3284-3547-0x0000000000420000-0x0000000000430000-memory.dmp

    Filesize

    64KB

  • memory/3284-3549-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

    Filesize

    4KB

  • memory/3284-3548-0x000000007FE20000-0x000000007FE21000-memory.dmp

    Filesize

    4KB

  • memory/3284-3546-0x0000000000420000-0x0000000000430000-memory.dmp

    Filesize

    64KB

  • memory/3284-3545-0x000000007FE40000-0x000000007FE41000-memory.dmp

    Filesize

    4KB

  • memory/3284-3578-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

    Filesize

    4KB

  • memory/3284-3579-0x000000007FE00000-0x000000007FE01000-memory.dmp

    Filesize

    4KB

  • memory/5124-1-0x0000000002AF0000-0x0000000002B00000-memory.dmp

    Filesize

    64KB

  • memory/5124-3542-0x0000000002AF0000-0x0000000002B00000-memory.dmp

    Filesize

    64KB

  • memory/5124-3544-0x0000000002AF0000-0x0000000002B00000-memory.dmp

    Filesize

    64KB

  • memory/5124-3543-0x0000000002AF0000-0x0000000002B00000-memory.dmp

    Filesize

    64KB

  • memory/5124-0-0x0000000002AF0000-0x0000000002B00000-memory.dmp

    Filesize

    64KB

  • memory/5124-2-0x0000000002AF0000-0x0000000002B00000-memory.dmp

    Filesize

    64KB