Analysis
-
max time kernel
66s -
max time network
35s -
platform
windows7_x64 -
resource
win7 -
submitted
29-09-2020 14:42
Static task
static1
Behavioral task
behavioral1
Sample
qeSw.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
qeSw.bin.exe
Resource
win10
General
-
Target
qeSw.bin.exe
-
Size
296KB
-
MD5
258ed03a6e4d9012f8102c635a5e3dcd
-
SHA1
a3bc2a30318f9bd2b51cb57e2022996e7f15c69e
-
SHA256
8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160
-
SHA512
967414274cb8d8fdf0e4dd446332b37060d54a726ab77f4ec704a5afe12162e098183add4342d1710db1e1c3b74035a001cf4c2d7790a27bf6d8381c34a96889
Malware Config
Extracted
C:\ProgramData\Microsoft\User Account Pictures\C907CC-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\C907CC-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker
Ransomware believed to be a variant of MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
qeSw.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\HideRestart.tif => C:\Users\Admin\Pictures\HideRestart.tif.c907cc qeSw.bin.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 4564 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 7476 IoCs
Processes:
qeSw.bin.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200183.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02752G.GIF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239943.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238959.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01180_.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_spellcheck.gif qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00641_.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PRRTINST.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0252629.WMF qeSw.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\C907CC-Readme.txt qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml qeSw.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239935.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00442_.WMF qeSw.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_over.gif qeSw.bin.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\C907CC-Readme.txt qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01740_.GIF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL097.XML qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsFormTemplate.html qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185774.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02124_.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BIZCARD.XML qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101860.BMP qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Charitable Contributions.accdt qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts2.css qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115834.GIF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DVDHM.POC qeSw.bin.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\83.0.4103.106.manifest qeSw.bin.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\C907CC-Readme.txt qeSw.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Karachi qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Apothecary.thmx qeSw.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml qeSw.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185806.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Graph.exe.manifest qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01239_.GIF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9B.GIF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierCloseButton.jpg qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02417_.WMF qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer qeSw.bin.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF qeSw.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\C907CC-Readme.txt qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00172_.WMF qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15301_.GIF qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h qeSw.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 904 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1788 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 8445 IoCs
Processes:
qeSw.bin.exepid process 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe 1032 qeSw.bin.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
qeSw.bin.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1032 qeSw.bin.exe Token: SeImpersonatePrivilege 1032 qeSw.bin.exe Token: SeBackupPrivilege 3836 vssvc.exe Token: SeRestorePrivilege 3836 vssvc.exe Token: SeAuditPrivilege 3836 vssvc.exe Token: SeDebugPrivilege 1788 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
qeSw.bin.execmd.exedescription pid process target process PID 1032 wrote to memory of 904 1032 qeSw.bin.exe vssadmin.exe PID 1032 wrote to memory of 904 1032 qeSw.bin.exe vssadmin.exe PID 1032 wrote to memory of 904 1032 qeSw.bin.exe vssadmin.exe PID 1032 wrote to memory of 904 1032 qeSw.bin.exe vssadmin.exe PID 1032 wrote to memory of 4528 1032 qeSw.bin.exe notepad.exe PID 1032 wrote to memory of 4528 1032 qeSw.bin.exe notepad.exe PID 1032 wrote to memory of 4528 1032 qeSw.bin.exe notepad.exe PID 1032 wrote to memory of 4528 1032 qeSw.bin.exe notepad.exe PID 1032 wrote to memory of 4564 1032 qeSw.bin.exe cmd.exe PID 1032 wrote to memory of 4564 1032 qeSw.bin.exe cmd.exe PID 1032 wrote to memory of 4564 1032 qeSw.bin.exe cmd.exe PID 1032 wrote to memory of 4564 1032 qeSw.bin.exe cmd.exe PID 4564 wrote to memory of 1788 4564 cmd.exe taskkill.exe PID 4564 wrote to memory of 1788 4564 cmd.exe taskkill.exe PID 4564 wrote to memory of 1788 4564 cmd.exe taskkill.exe PID 4564 wrote to memory of 1788 4564 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qeSw.bin.exe"C:\Users\Admin\AppData\Local\Temp\qeSw.bin.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\C907CC-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\1249.tmp.bat"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 10323⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1249.tmp.bat
-
C:\Users\Admin\Desktop\C907CC-Readme.txt
-
memory/904-0-0x0000000000000000-mapping.dmp
-
memory/1788-4-0x0000000000000000-mapping.dmp
-
memory/4528-1-0x0000000000000000-mapping.dmp
-
memory/4564-2-0x0000000000000000-mapping.dmp