Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
cf80fd95183ce1305becf6ea91d4ccfa0d87d923499d08939324d63c0ed22dc4.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
cf80fd95183ce1305becf6ea91d4ccfa0d87d923499d08939324d63c0ed22dc4.dll
Resource
win10v20201028
General
-
Target
cf80fd95183ce1305becf6ea91d4ccfa0d87d923499d08939324d63c0ed22dc4.dll
-
Size
57KB
-
MD5
1b6a2bfa39bcc335b1aff8217fe9e05f
-
SHA1
c21d6898e2a17bdb4a6af43534ee9c6534b244c9
-
SHA256
cf80fd95183ce1305becf6ea91d4ccfa0d87d923499d08939324d63c0ed22dc4
-
SHA512
c9feee9a867f2f9c1b1b71219f0906a547e89b138cbb1d08f6c3a5da63138df28c1752be57393ede93a7a910d86f9f3c5479bc4586ba909e94b1f18e866bb8d6
Malware Config
Extracted
C:\Users\Admin\Contacts\8D94CC-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File renamed C:\Users\Admin\Pictures\StepPush.tiff => C:\Users\Admin\Pictures\StepPush.tiff.8d94cc rundll32.exe File renamed C:\Users\Admin\Pictures\DismountDebug.raw => C:\Users\Admin\Pictures\DismountDebug.raw.8d94cc rundll32.exe File renamed C:\Users\Admin\Pictures\RepairStep.crw => C:\Users\Admin\Pictures\RepairStep.crw.8d94cc rundll32.exe File renamed C:\Users\Admin\Pictures\SearchInitialize.crw => C:\Users\Admin\Pictures\SearchInitialize.crw.8d94cc rundll32.exe File renamed C:\Users\Admin\Pictures\PublishWrite.tif => C:\Users\Admin\Pictures\PublishWrite.tif.8d94cc rundll32.exe File renamed C:\Users\Admin\Pictures\UnblockWrite.crw => C:\Users\Admin\Pictures\UnblockWrite.crw.8d94cc rundll32.exe File opened for modification C:\Users\Admin\Pictures\UnpublishUnregister.tiff rundll32.exe File opened for modification C:\Users\Admin\Pictures\StepPush.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\SendRedo.tiff => C:\Users\Admin\Pictures\SendRedo.tiff.8d94cc rundll32.exe File renamed C:\Users\Admin\Pictures\SetSearch.tif => C:\Users\Admin\Pictures\SetSearch.tif.8d94cc rundll32.exe File renamed C:\Users\Admin\Pictures\UnpublishUnregister.tiff => C:\Users\Admin\Pictures\UnpublishUnregister.tiff.8d94cc rundll32.exe File opened for modification C:\Users\Admin\Pictures\SendRedo.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\HideEdit.tif => C:\Users\Admin\Pictures\HideEdit.tif.8d94cc rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 7468 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL001.XML rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR11F.GIF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00668_.WMF rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.AU.XML rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_justify.gif rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF rundll32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\8D94CC-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POST.CFG rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02282_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XML2WORD.XSL rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hardware Tracker.fdt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.DPV rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14757_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_ON.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\LightSpirit.css rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATE.JPG rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow.css rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Beige.css rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB5B.BDR rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\8D94CC-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00559_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Martinique rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE06049_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\8D94CC-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02404_.WMF rundll32.exe File opened for modification C:\Program Files\7-Zip\descript.ion rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02073_.GIF rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Msgbox.accdt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00305_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02417U.BMP rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABMASK.BMP rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11 rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01064_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDownArrow.jpg rundll32.exe -
Suspicious behavior: EnumeratesProcesses 250 IoCs
Processes:
rundll32.exepid process 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe 1088 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 1088 rundll32.exe Token: SeImpersonatePrivilege 1088 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 536 wrote to memory of 1088 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 1088 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 1088 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 1088 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 1088 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 1088 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 1088 536 rundll32.exe rundll32.exe PID 1088 wrote to memory of 4872 1088 rundll32.exe notepad.exe PID 1088 wrote to memory of 4872 1088 rundll32.exe notepad.exe PID 1088 wrote to memory of 4872 1088 rundll32.exe notepad.exe PID 1088 wrote to memory of 4872 1088 rundll32.exe notepad.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf80fd95183ce1305becf6ea91d4ccfa0d87d923499d08939324d63c0ed22dc4.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf80fd95183ce1305becf6ea91d4ccfa0d87d923499d08939324d63c0ed22dc4.dll,#12⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\8D94CC-Readme.txt"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\8D94CC-Readme.txtMD5
599ea13c819fa6326de6cea86fdf793a
SHA198b22b0b9849b58dc250b232fb4b5f09981ac530
SHA256c4c7b327426f87280affe969f8c853139f4b706bc6af2fdfc51f4ff407f27896
SHA5122fe7ecb9f01a2e154c956c7698523349b1e0fb577d879c78aacc3de0ee832359acb2593299238fc8afce55f7871cac75f131e1f9eb585d748b6830be166f43da
-
memory/1088-0-0x0000000000000000-mapping.dmp
-
memory/4872-1-0x0000000000000000-mapping.dmp