CYPHERLOCK, INC.

On June 20, 2024, the Indonesian National Data Center was disrupted by a cyberattack that took down government services. The outage was linked to a fresh hacker group deploying a new variant of ransomware known as Brain Cipher.

Brain Cipher, a modified version of the LockBit ransomware family, was developed using the leaked LockBit 3.0 Builder. This ransomware variant has been used globally in double-extortion attacks, where the perpetrators steal data before encrypting it.

To provide actionable insights, we will analyze Brain Cipher through both static and dynamic methods, and demonstrate how to detect and block it using Cynet’s All-in-One Cybersecurity Solution.

Static Analysis

Static analysis involves examining Brain Cipher’s source code to understand its functions and capabilities:

• Brain Cipher’s file strings do not reveal specific operations it is designed to perform.
• Because the file is packed, full execution is required to uncover its complete functionality.

Dynamic Analysis

Dynamic analysis involves running Brain Cipher in a controlled setting to observe its behavior:

• Upon execution, Brain Cipher runs DllHost.exe with parameters linked to the CLASID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}. This CLASID is associated with cmstplua.dll, a file frequently exploited to bypass User Account Control (UAC).
• DllHost.exe spawns a new instance of the Brain Cipher executable, terminating the original process.
• The new instance generates a ransom note file named C:\sYMY1N6ah.README.txt.
• It then scans the file system and begins encrypting files. Encrypted files are renamed with random strings and appended with the .sYMY1N6ah extension.
• A ransom note is placed in every affected directory, prohibiting victims from contacting authorities or attempting to recover files themselves. Instead, victims are instructed to reach out through an Onion page on the TOR network.
• The process also tries to create a file at \\<Hostname>*\MAILSLOT\NET\NETLOGON, utilizing the Remote Mailslot Protocol for communication over NetBIOS datagram transport protocol. This is used by the Netlogon Remote Protocol to identify domain controllers.
• It modifies Windows registry keys related to event logs to disable future logging and prevent access to existing logs. Attempts to view these logs will show an error message, and the Windows Event Viewer will appear empty.
• The process creates and executes C:\ProgramData\9EA9.tmp, then renames the Brain Cipher executable through a sequence of names on the desktop before deleting the file. The 9EA9.tmp file executes cmd.exe, which then deletes itself and terminates the malware’s operation.

Cynet’s Response to Brain Cipher

We will demonstrate how Cynet’s All-in-One Cybersecurity Platform detects and prevents Brain Cipher:

• During the simulation, Cynet is set to Detection Mode, allowing Brain Cipher’s full attack flow to be observed and logged.
• Cynet’s platform employs four layers of defense to detect and thwart this ransomware:

1. File Detection: Cynet’s AV/AI engine identifies malicious files on disk or attempting to execute.
2. Binary Analysis: Cynet assesses the file’s SSDEEP hash value to confirm its malicious nature.
3. Process Monitoring: Cynet detects attempts to bypass UAC for privilege escalation and identifies the execution of unsigned processes.
4. File Operations: Cynet monitors and reports attempts by Brain Cipher to modify ransomware decoy files and create ransom notes.

Protective Measures

Given that Brain Cipher is typical of financially motivated threats, organizations—particularly MSPs and small-to-medium enterprises with limited cybersecurity resources—should adopt cost-effective protective measures to mitigate their risk.

Cynet offers a comprehensive security suite within a single, user-friendly solution. To see these capabilities in action, sign up for a live simulation of real-world threats or schedule a personalized demo with Cynet experts today.