Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
92e4d38e17e4dc32519df7324013477908c9cb725ea29aea6e4fd8c27eb7087d.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
92e4d38e17e4dc32519df7324013477908c9cb725ea29aea6e4fd8c27eb7087d.dll
Resource
win10v20201028
General
-
Target
92e4d38e17e4dc32519df7324013477908c9cb725ea29aea6e4fd8c27eb7087d.dll
-
Size
93KB
-
MD5
239163e6019670e326087aa59adb5007
-
SHA1
c26d5fbe02f8b0e6a40672b12e69ee78343e9a41
-
SHA256
92e4d38e17e4dc32519df7324013477908c9cb725ea29aea6e4fd8c27eb7087d
-
SHA512
54a02d9fb98bc8d9dca8019621b61f501080bd0cee241fcaa84e77cc2a4ece5ee5b7a44dd675d5a421b1c48af9ce4ce321b89e9204c99e28e56f90bdeae59410
Malware Config
Extracted
C:\2D8AA1-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Desktop\2D8AA1-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File renamed C:\Users\Admin\Pictures\UnlockSuspend.tif => C:\Users\Admin\Pictures\UnlockSuspend.tif.2d8aa1 rundll32.exe File renamed C:\Users\Admin\Pictures\ResumeHide.crw => C:\Users\Admin\Pictures\ResumeHide.crw.2d8aa1 rundll32.exe File renamed C:\Users\Admin\Pictures\RedoPublish.crw => C:\Users\Admin\Pictures\RedoPublish.crw.2d8aa1 rundll32.exe File renamed C:\Users\Admin\Pictures\ExitSet.tiff => C:\Users\Admin\Pictures\ExitSet.tiff.2d8aa1 rundll32.exe File renamed C:\Users\Admin\Pictures\CloseNew.crw => C:\Users\Admin\Pictures\CloseNew.crw.2d8aa1 rundll32.exe File renamed C:\Users\Admin\Pictures\ResizeDisable.png => C:\Users\Admin\Pictures\ResizeDisable.png.2d8aa1 rundll32.exe File opened for modification C:\Users\Admin\Pictures\ExitSet.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\UndoBackup.png => C:\Users\Admin\Pictures\UndoBackup.png.2d8aa1 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 7481 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\2D8AA1-Readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\TITLE.XSL rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Samara rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7 rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\2D8AA1-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105294.WMF rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCARD.DPV rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\VisualElements\Logo.png rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\2D8AA1-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar rundll32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\2D8AA1-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107258.WMF rundll32.exe File opened for modification C:\Program Files\WatchExpand.m4v rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ACCSBAR.POC rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.xsl rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2 rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\2D8AA1-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericon.jpg rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01634_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielMergeLetter.Dotx rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.CSS rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\2D8AA1-Readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\management-agent.jar rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235241.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR2B.GIF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLMAIL.FAE rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14829_.GIF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0089992.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXT rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\LightSpirit.css rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02371_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\2D8AA1-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301076.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212957.WMF rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18251_.WMF rundll32.exe -
Suspicious behavior: EnumeratesProcesses 243 IoCs
Processes:
rundll32.exepid process 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe 484 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 484 rundll32.exe Token: SeImpersonatePrivilege 484 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 484 wrote to memory of 3924 484 rundll32.exe notepad.exe PID 484 wrote to memory of 3924 484 rundll32.exe notepad.exe PID 484 wrote to memory of 3924 484 rundll32.exe notepad.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92e4d38e17e4dc32519df7324013477908c9cb725ea29aea6e4fd8c27eb7087d.dll,#11⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\2D8AA1-Readme.txt"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\2D8AA1-Readme.txtMD5
785c7cae540af53d5f281e3799819ac3
SHA1d3619d1ed0067fe372b83fe8a066ea994018907c
SHA25628716e4d55ce795e67862448a8e705720c553a009ac20586dadc3be110a3e951
SHA512de9e3527af2b33b70d592fec43716207f90b65adf61f46282ab4f9806e6c4b4d5212964bde6563e159278c4571bbf68bf6137595050fe3f6a15e9d93e4cb1d77
-
memory/3924-0-0x0000000000000000-mapping.dmp