Analysis
-
max time kernel
157s -
max time network
62s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
8c5ce574ae676e0687e803e78c52e3c8672f7dbc4a63655c1067f2849135da25.bin.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
8c5ce574ae676e0687e803e78c52e3c8672f7dbc4a63655c1067f2849135da25.bin.dll
Resource
win10v20201028
General
-
Target
8c5ce574ae676e0687e803e78c52e3c8672f7dbc4a63655c1067f2849135da25.bin.dll
-
Size
57KB
-
MD5
9fb87ac9c00ea780bad678cb5bde676c
-
SHA1
887ba63ac7c37bb418f43cc5d978f1d2695df46c
-
SHA256
8c5ce574ae676e0687e803e78c52e3c8672f7dbc4a63655c1067f2849135da25
-
SHA512
ea16de3b0fcdf71214617a78d319f150653718ff6bd589290a085534c23e5cbc5c6e03cc79bb528d9e088373923faa66c8e37517b467c5f5f63d6b939c9baf97
Malware Config
Extracted
C:\Program Files\Microsoft Office\Office14\6E3720-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\6E3720-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\6E3720-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File renamed C:\Users\Admin\Pictures\MeasureResolve.tiff => C:\Users\Admin\Pictures\MeasureResolve.tiff.6e3720 rundll32.exe File renamed C:\Users\Admin\Pictures\ResolveUnlock.raw => C:\Users\Admin\Pictures\ResolveUnlock.raw.6e3720 rundll32.exe File renamed C:\Users\Admin\Pictures\EditStart.tif => C:\Users\Admin\Pictures\EditStart.tif.6e3720 rundll32.exe File renamed C:\Users\Admin\Pictures\MountFind.tif => C:\Users\Admin\Pictures\MountFind.tif.6e3720 rundll32.exe File renamed C:\Users\Admin\Pictures\WriteResolve.crw => C:\Users\Admin\Pictures\WriteResolve.crw.6e3720 rundll32.exe File opened for modification C:\Users\Admin\Pictures\MeasureResolve.tiff rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 4101 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143744.GIF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CONTACTINFOBB.DPV rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Monterrey rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\6E3720-Readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Martinique rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini rundll32.exe File created C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\6E3720-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Premium.css rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21328_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10297_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0157995.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Thatch.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0278882.WMF rundll32.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\6E3720-Readme.txt rundll32.exe File opened for modification C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp rundll32.exe File opened for modification C:\Program Files\Windows Journal\Templates\Music.jtp rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESP.CFG rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\rt.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt rundll32.exe File opened for modification C:\Program Files\Windows Journal\Templates\Graph.jtp rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEM.CFG rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OWSHLP10.CHM rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLAPPTR.FAE rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Tags.accft rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Person.gif rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0205462.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginLetter.Dotx rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OEMPRINT.CAT rundll32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\6E3720-Readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chicago rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rainy_River rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_en.dub rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_F_COL.HXK rundll32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
rundll32.exepid process 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 1652 rundll32.exe Token: SeImpersonatePrivilege 1652 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1752 wrote to memory of 1652 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1652 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1652 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1652 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1652 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1652 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1652 1752 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5ce574ae676e0687e803e78c52e3c8672f7dbc4a63655c1067f2849135da25.bin.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5ce574ae676e0687e803e78c52e3c8672f7dbc4a63655c1067f2849135da25.bin.dll,#12⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1652-0-0x0000000000000000-mapping.dmp