Overview

overview

10

Static

static

10

b2493a5801...49.exe

windows11-ltsc_2024-x64

10

Resubmissions

13/11/2026, 05:40

261113-gdatjsfz5x10

23/02/2025, 12:47

250223-p1bclaxlby10

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 05:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
  • Size 719KB
  • Sample261113-gdatjsfz5x
  • SHA256 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverymedusalockerneshtapersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Recovery\WindowsRE\Recovery_Instructions.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">9FE3A3C6D6F375B7556BFBFE9B6CC880A71524AFB11E9C748E0B56FE6BAAE957A640FE7A8A7C0B35846BBF04A21091DA58EA7944CA2986DA4877EA8E5087C044<br>F9938AD5F56BB8E7114A93AB2AE6B285720A629CB398BBB798528B37C5E9839791911AEC23A5F203BA7C4433994BAC709D157538984D4167E907F1EF9B1D<br>3FFBCB28CC389C6F559D88233D2978B5B01BA2D03E8B3A254CD1CC37A9805D061EC71D5CA583249994D5F3159540758BEE3A19F0DFF3E9B7985E9BC318DF<br>8BD3EFD820A6BE2911E94945794D514DAD79BA9C762C9F56554CF30723E72A90A35932E5B5C79DFE50A2B5AB83843FF5265CA705DBEB593E827E2501C5B8<br>96E8D6E3DC4E2C72E80AAD45B5F4389F9A19154F97BA5898218E18AAE4DC1D68065AAC4E87FF56E7D39757A18B4968FCAC24F14D3C78D0CE2C300067AC8F<br>71D1D82E5132CC1223A23382054428D743E4F8CDCB0CE6DE341ABC9DC3585831BCDAC6DD99CBEC89C9FF4D0E3E8B2D9595738B0DC29F96DBD371044D3940<br>772BE29B4DDD3148F20764CA8ED0B288ADBF6663978DC3DD6B916E81502786C1DECD3237E1F1D475D9D269D92B1BD7EF321C0A247D710112828AC9F2A88A<br>07D9AD88C10BA0F7989E30088DD099CB484CB5FBAA559C2F6BA7A476348B14458A0331240FC04E18E553697FC6FDD6A31BE46BB03A2DF4CFBBA7FE86A6B7<br>9D4229572B2EFC93FD5304EEC402</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-KClsZhqCXhKTcSRRIAnVBD8jbDuBTWcK</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected]</a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Extracted

Path

  • C:\Users\Admin\Downloads\Recovery_Instructions.html

  • medusalocker

Ransom Note
  • Your personal ID: 9FE3A3C6D6F375B7556BFBFE9B6CC880A71524AFB11E9C748E0B56FE6BAAE957A640FE7A8A7C0B35846BBF04A21091DA58EA7944CA2986DA4877EA8E5087C044 F9938AD5F56BB8E7114A93AB2AE6B285720A629CB398BBB798528B37C5E9839791911AEC23A5F203BA7C4433994BAC709D157538984D4167E907F1EF9B1D 3FFBCB28CC389C6F559D88233D2978B5B01BA2D03E8B3A254CD1CC37A9805D061EC71D5CA583249994D5F3159540758BEE3A19F0DFF3E9B7985E9BC318DF 8BD3EFD820A6BE2911E94945794D514DAD79BA9C762C9F56554CF30723E72A90A35932E5B5C79DFE50A2B5AB83843FF5265CA705DBEB593E827E2501C5B8 96E8D6E3DC4E2C72E80AAD45B5F4389F9A19154F97BA5898218E18AAE4DC1D68065AAC4E87FF56E7D39757A18B4968FCAC24F14D3C78D0CE2C300067AC8F 71D1D82E5132CC1223A23382054428D743E4F8CDCB0CE6DE341ABC9DC3585831BCDAC6DD99CBEC89C9FF4D0E3E8B2D9595738B0DC29F96DBD371044D3940 772BE29B4DDD3148F20764CA8ED0B288ADBF6663978DC3DD6B916E81502786C1DECD3237E1F1D475D9D269D92B1BD7EF321C0A247D710112828AC9F2A88A 07D9AD88C10BA0F7989E30088DD099CB484CB5FBAA559C2F6BA7A476348B14458A0331240FC04E18E553697FC6FDD6A31BE46BB03A2DF4CFBBA7FE86A6B7 9D4229572B2EFC93FD5304EEC402 /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-KClsZhqCXhKTcSRRIAnVBD8jbDuBTWcK * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: [email protected] [email protected] * To contact us, create a new mail on the site: protonmail.com Make contact as soon as possible. Your private key (decryption key) is only stored temporarily. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
URLs

  • http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-KClsZhqCXhKTcSRRIAnVBD8jbDuBTWcK

Signatures

  • Family: MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 12 IoCs
  • MedusaLocker payload 2 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Renames multiple (155) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
    "C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5544
    • C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4036
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5176
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5492
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4216
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4104
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4364
    • C:\Users\Admin\AppData\Roaming\svhost.exe
      "C:\Users\Admin\AppData\Roaming\svhost.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1608
        • C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
          C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:620

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Modify Registry

          3
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AcroRd32.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
          • Size 2.4MB
          • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Recovery_Instructions.html
          • Path C:\Recovery\WindowsRE\Recovery_Instructions.html
          • Size 4KB
          • SHA256 12d9a48d276e778f23f9e321d656100208690e284a1717d518848b7fd74fb307
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
          • Size 678KB
          • SHA256 73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tmp5023.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
          • Size 8B
          • SHA256 1dddf9e74989ad86cc9df97cd1827231b7b832cbc6b24672ce59d2bdd84b2c53
          • MD5 SHA1 SHA512
          Submit Download

          svhost.exe
          • Path C:\Users\Admin\AppData\Roaming\svhost.exe
          • Size 719KB
          • SHA256 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AddCheckpoint.vdw
          • Path C:\Users\Admin\Downloads\AddCheckpoint.vdw
          • Size 760KB
          • SHA256 f75c9bc20c62e0274985b8b1b745ac09ac8903bcfd278b4b04be223794d69994
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CheckpointUnprotect.kix.ReadInstructions
          • Path C:\Users\Admin\Downloads\CheckpointUnprotect.kix.ReadInstructions
          • Size 912KB
          • SHA256 61367d9aac1374fcb1ba785459efe9138888c42c6d0da72a879bfa69316a693e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Recovery_Instructions.html
          • Path C:\Users\Admin\Downloads\Recovery_Instructions.html
          • Size 4KB
          • SHA256 12d9a48d276e778f23f9e321d656100208690e284a1717d518848b7fd74fb307
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NTUSER.DAT{1ecfa226-ae7d-11f1-b6ed-f6a453ebf8fd}.TMContainer00000000000000000002.regtrans-ms
          • Path C:\Users\Default\NTUSER.DAT{1ecfa226-ae7d-11f1-b6ed-f6a453ebf8fd}.TMContainer00000000000000000002.regtrans-ms
          • Size 512KB
          • SHA256 26f0990ff1378d557cdb6dce6ce16b2bd229f994c5546cbbae216605d9120447
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          svchost.com
          • Path C:\Windows\svchost.com
          • Size 40KB
          • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BCD.LOG2
          • Path \Device\HarddiskVolume1\Boot\BCD.LOG2
          • Size 536B
          • SHA256 58d1dafac36e049fb51ed66d94aaeb78969e7b46bfd80d200212c687d65d66d0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          desktop.ini
          • Path \Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-53044966-3830981193-2402648431-1000\desktop.ini
          • Size 129B
          • SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1608-808-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/2748-802-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5544-761-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5544-789-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5544-794-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5544-788-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5544-787-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5544-786-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5544-300-0x0000000000400000-0x000000000041B000-memory.dmp
          Download