Analysis
-
max time kernel
45s -
max time network
110s -
platform
windows10_x64 -
resource
win10 -
submitted
29-09-2020 14:42
Static task
static1
Behavioral task
behavioral1
Sample
qeSw.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
qeSw.bin.exe
Resource
win10
General
-
Target
qeSw.bin.exe
-
Size
296KB
-
MD5
258ed03a6e4d9012f8102c635a5e3dcd
-
SHA1
a3bc2a30318f9bd2b51cb57e2022996e7f15c69e
-
SHA256
8639825230d5504fd8126ed55b2d7aeb72944ffe17e762801aab8d4f8f880160
-
SHA512
967414274cb8d8fdf0e4dd446332b37060d54a726ab77f4ec704a5afe12162e098183add4342d1710db1e1c3b74035a001cf4c2d7790a27bf6d8381c34a96889
Malware Config
Extracted
C:\9FE004-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\VideoLAN\VLC\lua\http\9FE004-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\VideoLAN\VLC\lua\playlist\9FE004-Readme.txt
netwalker
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker
Ransomware believed to be a variant of MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
qeSw.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\SaveSend.raw => C:\Users\Admin\Pictures\SaveSend.raw.9fe004 qeSw.bin.exe File renamed C:\Users\Admin\Pictures\ClearExit.raw => C:\Users\Admin\Pictures\ClearExit.raw.9fe004 qeSw.bin.exe File renamed C:\Users\Admin\Pictures\WaitRevoke.png => C:\Users\Admin\Pictures\WaitRevoke.png.9fe004 qeSw.bin.exe File renamed C:\Users\Admin\Pictures\ReceiveEnter.png => C:\Users\Admin\Pictures\ReceiveEnter.png.9fe004 qeSw.bin.exe File renamed C:\Users\Admin\Pictures\ConvertMove.png => C:\Users\Admin\Pictures\ConvertMove.png.9fe004 qeSw.bin.exe File renamed C:\Users\Admin\Pictures\DisconnectFormat.png => C:\Users\Admin\Pictures\DisconnectFormat.png.9fe004 qeSw.bin.exe File renamed C:\Users\Admin\Pictures\StepEnter.raw => C:\Users\Admin\Pictures\StepEnter.raw.9fe004 qeSw.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Drops file in Program Files directory 17066 IoCs
Processes:
qeSw.bin.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\plugin.js qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Gravel.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-100_contrast-white.png qeSw.bin.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\9FE004-Readme.txt qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\9FE004-Readme.txt qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-150.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-125.png qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\SkypeLargeTile.scale-200.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_11c.png qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\ui-strings.js qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\jm_60x42.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\InGame_Controls.jpg qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-400.png qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectAppList.targetsize-48.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\mask\1h.png qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info.png qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\sfs_icons.png qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-125.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-200.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Klondike\Tips_1.jpg qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\fr-FR.PhoneNumber.SMS.model qeSw.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\9FE004-Readme.txt qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Cloud.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\commonassets.xml qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-300.png qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\ui-strings.js qeSw.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\9FE004-Readme.txt qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\AppxSignature.p7x qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White@3x.png qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_auditreport_18.svg qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-white_scale-200.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\pa_16x11.png qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sl_get.svg qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar qeSw.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\Attribution\kweather.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.wink.small.scale-200.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_contrast-white.png qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\WINGDNG3.TTF qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-dark-disabled_32.svg qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\AppxManifest.xml qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-125.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_TH-TH.respack qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js qeSw.bin.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailSmallTile.scale-200.png qeSw.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-hover_32.svg qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png qeSw.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\makeup.png qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\pages\winrthost.htm qeSw.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-16_altform-unplated.png qeSw.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1228 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4980 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 12121 IoCs
Processes:
qeSw.bin.exepid process 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe 2168 qeSw.bin.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
qeSw.bin.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2168 qeSw.bin.exe Token: SeImpersonatePrivilege 2168 qeSw.bin.exe Token: SeBackupPrivilege 1452 vssvc.exe Token: SeRestorePrivilege 1452 vssvc.exe Token: SeAuditPrivilege 1452 vssvc.exe Token: SeDebugPrivilege 4980 taskkill.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
qeSw.bin.execmd.exedescription pid process target process PID 2168 wrote to memory of 1228 2168 qeSw.bin.exe vssadmin.exe PID 2168 wrote to memory of 1228 2168 qeSw.bin.exe vssadmin.exe PID 2168 wrote to memory of 6400 2168 qeSw.bin.exe notepad.exe PID 2168 wrote to memory of 6400 2168 qeSw.bin.exe notepad.exe PID 2168 wrote to memory of 6400 2168 qeSw.bin.exe notepad.exe PID 2168 wrote to memory of 4952 2168 qeSw.bin.exe cmd.exe PID 2168 wrote to memory of 4952 2168 qeSw.bin.exe cmd.exe PID 2168 wrote to memory of 4952 2168 qeSw.bin.exe cmd.exe PID 4952 wrote to memory of 4980 4952 cmd.exe taskkill.exe PID 4952 wrote to memory of 4980 4952 cmd.exe taskkill.exe PID 4952 wrote to memory of 4980 4952 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qeSw.bin.exe"C:\Users\Admin\AppData\Local\Temp\qeSw.bin.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\9FE004-Readme.txt"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BE35.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 21683⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BE35.tmp.bat
-
C:\Users\Admin\Desktop\9FE004-Readme.txt
-
memory/1228-0-0x0000000000000000-mapping.dmp
-
memory/4952-2-0x0000000000000000-mapping.dmp
-
memory/4980-4-0x0000000000000000-mapping.dmp
-
memory/6400-1-0x0000000000000000-mapping.dmp