Analysis
-
max time kernel
155s -
max time network
167s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
eb1470786fda58fc8291e099c7fcd5d36a04de85d1f6fe8683c1950b7119314e.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
eb1470786fda58fc8291e099c7fcd5d36a04de85d1f6fe8683c1950b7119314e.dll
Resource
win10v20201028
General
-
Target
eb1470786fda58fc8291e099c7fcd5d36a04de85d1f6fe8683c1950b7119314e.dll
-
Size
57KB
-
MD5
cc113e42c52c6e4e7beca74829b89a68
-
SHA1
5b165601b8d0b13a8833c31cb36644aea8121f74
-
SHA256
eb1470786fda58fc8291e099c7fcd5d36a04de85d1f6fe8683c1950b7119314e
-
SHA512
b18bafbf70140a334a8dca2c99c25dae0be448ee90c0eaf65a37d95990477f4da94f75311b4004c64c75bc52f2ac8be880c7bb82f33130ff8c9031edb7781a3c
Malware Config
Extracted
C:\Users\Public\Libraries\EFA749-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\EFA749-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\EFA749-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Microsoft Office\Stationery\1033\EFA749-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File renamed C:\Users\Admin\Pictures\DebugRepair.tif => C:\Users\Admin\Pictures\DebugRepair.tif.efa749 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 7480 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files\Windows Journal\Templates\Genko_2.jtp rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00433_.WMF rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\EFA749-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDownArrow.jpg rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME03.CSS rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImages.jpg rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Graph.exe.manifest rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101980.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0172067.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0295069.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\CALENDAR.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHPHN.DAT rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\EFA749-Readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02296_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEM.CFG rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_disable.gif rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\gradient.png rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21320_.GIF rundll32.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\EFA749-Readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL093.XML rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTEAR.DPV rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00272_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN089.XML rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299763.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS.DPV rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BZCARD11.POC rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanMergeLetter.Dotx rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_ON.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21366_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195772.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right_over.gif rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Brussels rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\EFA749-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Aspect.thmx rundll32.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\EFA749-Readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309567.JPG rundll32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\EFA749-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF rundll32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
rundll32.exepid process 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe 1560 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 1560 rundll32.exe Token: SeImpersonatePrivilege 1560 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 380 wrote to memory of 1560 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1560 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1560 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1560 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1560 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1560 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1560 380 rundll32.exe rundll32.exe PID 1560 wrote to memory of 7924 1560 rundll32.exe notepad.exe PID 1560 wrote to memory of 7924 1560 rundll32.exe notepad.exe PID 1560 wrote to memory of 7924 1560 rundll32.exe notepad.exe PID 1560 wrote to memory of 7924 1560 rundll32.exe notepad.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb1470786fda58fc8291e099c7fcd5d36a04de85d1f6fe8683c1950b7119314e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb1470786fda58fc8291e099c7fcd5d36a04de85d1f6fe8683c1950b7119314e.dll,#12⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\EFA749-Readme.txt"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\EFA749-Readme.txtMD5
32c558876244e22347ff49ea9ea01858
SHA143f14a0c21939ad56abcbf643baa2829450a41cd
SHA256f278660ae38ed072be640adc38d0caeeb9ce82bd128af02c801cf0321a59de78
SHA5126a16633a0b3e84152b38c96d7c318e24f40e21fc6b132c50080241cee9b8a4c421aa72899fa3daa93b71c6a308107dbca38416f1f688a553156ada8ca4ede9b0
-
memory/1560-0-0x0000000000000000-mapping.dmp
-
memory/7924-1-0x0000000000000000-mapping.dmp