cuba | a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea

max time kernel
899s
max time network
382s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
Size 139KB
Sample260422-nlw53sdz2m
SHA256 a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea
MD5 7f3656e2687f0ccc6f777aac639748f5
SHA1 e4f934d18cae5c0e0e93516d089184201bd37b11
SHA512 ab9cd8128c2d0a436239a58b5985af37f15f4bcd2e39ced569c3ad88c6e6088cea012302b02a4f359490fa7a8cc921d8e2c7561224c520659701e7e69a955ed7
SSDEEP 3072:VktRlIu3zyqqoShIpLvnCfcFtv42pbTAn0WtsbM5H:etAu42pLztyEM5H
TLSH
T127D39D11B5C1C472E4B7093119BADAB19D3EF9300B518DEBA3D4066A0F351D1BE3AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cuba ransomware

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\!! READ ME !!.txt

Ransom Note

Greetings! Unfortunately we have to report you that your company were compromised. All your files were encrypted and you can't restore them without our private key. Trying to restore it without our help may cause complete loss of your data. Also we researched whole your corporate network and downloaded all your sensitive data to our servers. If we will not get any contact from you in 3 next days we will public it in our news site. You can find it there ( http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/�) Tor Browser is needed ( https://www.torproject.org/download/�) Also we respect your work and time and we are open for communication. In that case we are ready to discuss recovering your files and work. We can grant absolute privacy and compliance with agreements by our side. Also we can provide all necessary evidence to confirm performance of our products and statements. Feel free to contact us with quTox ( https://tox.chat/download.html�) Our ToxID: 37790E2D198DFD20C9D2887D4EF7C3E2951BB84248D192689B64DCCA3C8BD808A1895676B271 Alternative method is email: [email protected] Mark your messages with your personal ID: GA6GD342D0

Emails

[email protected]

URLs

http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/�
https://tox.chat/download.html�

Signatures

Family: Cuba, COLDDRAW
Cuba aka COLDDRAW is a ransomware first seen in 2019.
ransomware cuba
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 4648	5872	a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe	79

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Windows\SysWOW64\cmd.exe
  /c del C:\Users\Admin\AppData\Local\Temp\Red-Flaged\a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

stable.identity_helper.exe.manifest

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\stable.identity_helper.exe.manifest
Size 2KB
SHA256 39bb686e30bada44d8d293ea051c6cd4f5252c0c9b709c322cac13eb3795f365
MD5 cda55483e9e919303d65e5eb0f1193f0
SHA1 6f757f0ad960d299f34574700a34ada7265056d8
SHA512 e855480532568d1de2f885ab3ac842e94ae341effc62540844a570f6f4f7fce6e0a2cf69c83ba0ec22b5f982e6c6355759ec74e3e12a5aa236aeb15f06de92fb
TLSH
T1CB512A80DCFDA41BCAE04D7B64F0259979DA1B5F1EA81115033483D4F77D3AE2497C40
MD5 SHA1 SHA512 TLSH

Submit Download

!! READ ME !!.txt

Path C:\Program Files\Common Files\microsoft shared\ink\ar-SA\!! READ ME !!.txt
Size 1KB
SHA256 503e4427855878d8e5eec68b589578f4461b1cffca2013341eb43d5cb5d3ba2e
MD5 f566098bab8665337b322322262e8c2b
SHA1 3ca68babdfbd2b3cac5cddd62dc1d80e299accc8
SHA512 577b6651c53ebe314055fdcfc87c3d3a60cd38ec8e4071f4f0931e149f29df4686f21e7b68454bb97f4b0d528b429a313d19db4dea1c7c61ffaf2f91a0f45f3b
TLSH
T10521216FEF2AB019154262903A48A9E8BA0B815C2A65C09258B8044C27751E3973E2EB
MD5 SHA1 SHA512 TLSH

Submit Download