564c6d1973910e06c66670708fdc809d7391d03fd65d5e71d6d154f898429c93

General

Target

KMSAuto Net.exe
Size

2.1MB
MD5

26d067caae83528460ed322ae8cf7ab9
SHA1

470f0522a5debbbeb0a8d5c3e0a3dc1af6a1344f
SHA256

564c6d1973910e06c66670708fdc809d7391d03fd65d5e71d6d154f898429c93
SHA512

7f8c96f52f9e01985da14169c836cf0a7878580c312b6ba4b22b7b36fd2324b64deedab8f21221cae744ce0c3c55e6e0bfbcb4c78ffd8cac03b2c1c5fa9e0e81

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_RESTORE_FILES.txt

Ransom Note

******************************ATTENTION!****************************** All your important files have been encrypted by STEEL Ransomware! For encryption we use reliable algorithms! You can read more here: https://en.wikipedia.org/wiki/RSA_(cryptosystem) https://en.wikipedia.org/wiki/Advanced_Encryption_Standard Many of your documents, photos, videos, images and other files are no longer accessible because they have been encrypted. It means that your files are not damaged, but modified. The reverse process is called decryption. We use strong algorithms so it impossible to crack key. You can easily restore all your files. We guarantee that all your files will be successfully decrypted after paying. We can decrypt 2 files for free (size <2mb) as proof that we can decrypt your files. Warning! After 7 days price will be doubled! How to decrypt files ? 1) Contact us via email [email protected] 2) Pay $350 on our monero wallet (we will send you wallet address) 3) Send your personal key to our email (It's located at the end of this document) 4) Get decryption key and program 5) Decrypt all your files ******************************????????!****************************** ??? ???? ????? ??????????? STEEL Ransomware! ??? ?????????? ???????????? ???????? ????????? ??????????. ?? ?????? ???????????? ????????? ?????: https://en.wikipedia.org/wiki/RSA_(cryptosystem) https://en.wikipedia.org/wiki/Advanced_Encryption_Standard ???? ?????????, ?????, ????, ???????? ? ?????? ????? ?????? ??????????, ?????? ??? ??? ???????????. ??? ??????, ??? ???? ????? ?? ??????????, ?? ??????????????. ???????? ??????? ?????????? ????????????. ???????? ??? ????????? ????? ???????????? ??????????! ?? ?????? ????? ???????????? ??? ?????. ?? ???????????, ??? ??? ???? ????? ????? ??????? ???????????? ????? ??????. ? ???????? ?????????????? ??????????? ?????- ??????? ?? ????? ????????? ???????????? 2 ????? ???????? ?? ????? 2 ??. ????????! ????? 7 ???? ???? ????? ???????! ??? ???????????? ?????? 1)????????? ? ???? ????? e-mail [email protected] 2)???????? 350 USD ?? monero ???????, ??????? ?? ?????? ??? 3)????????? ??? ????, ????????????? ? ????? ????? ?????????. 4)???????? ?????????-?????????? ? ???? 5)??????????? ???? ????? YOUR PERSONAL KEY HERE: ----------BEGIN STEEL KEY---------- m7uF2wMnEjZPWZk77en5lFKHnG8KBKeyUEWu+GtXV78SwEe8zRQuZTzzUdMTqqzo E2I6x+m2H7qwwjjz0jgLsosvd4/NCsHkiFvUlBolGNVljggix9dsPP9pXtoHSGCA ZCl0l/uBXuWxKWoWbwg5Ng6jP2B7Px1HaNxnXrI5X/YDqN+YamL4soTKtxV+HXa0 g4DOIIBnaNx6btQx/9+lu4GAEcxnhnkb3eB5s1t3gpBcvgnz6FDItM0Pz7evQDPL qUQJLJDtSofdkF5xfCEDSTDpxnhWf31R9WODWL7zNFi/njGEaslO13tuvj1OiDRM MCUf5o0FB5W5U5eXxB7fBw== ----------END STEEL KEY----------

Emails

[email protected]

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1032	SWEfghd678hfjbbhbGFrca.exe
1780	loader.exe

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\OpenEnter.tif.xFjdo	loader.exe
File created	C:\Users\Admin\Pictures\RenameConnect.tif.xFjdo	loader.exe
File created	C:\Users\Admin\Pictures\WatchRename.png.xFjdo	loader.exe
File created	C:\Users\Admin\Pictures\DisconnectMeasure.tiff.xFjdo	loader.exe
File created	C:\Users\Admin\Pictures\EnterRequest.raw.xFjdo	loader.exe
File created	C:\Users\Admin\Pictures\ExportGroup.png.xFjdo	loader.exe
File created	C:\Users\Admin\Pictures\FindAdd.png.xFjdo	loader.exe

Loads dropped DLL 6 IoCs

pid	Process
1784	KMSAuto Net.exe
1032	SWEfghd678hfjbbhbGFrca.exe
1032	SWEfghd678hfjbbhbGFrca.exe
1032	SWEfghd678hfjbbhbGFrca.exe
1032	SWEfghd678hfjbbhbGFrca.exe
1780	loader.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	loader.exe
File opened (read-only)	\??\B:	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_Classes\Local Settings	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2028	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1780	loader.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1224	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1032	1784	KMSAuto Net.exe	26
PID 1784 wrote to memory of 1032	1784	KMSAuto Net.exe	26
PID 1784 wrote to memory of 1032	1784	KMSAuto Net.exe	26
PID 1784 wrote to memory of 1032	1784	KMSAuto Net.exe	26
PID 1784 wrote to memory of 1184	1784	KMSAuto Net.exe	27
PID 1784 wrote to memory of 1184	1784	KMSAuto Net.exe	27
PID 1784 wrote to memory of 1184	1784	KMSAuto Net.exe	27
PID 1784 wrote to memory of 1184	1784	KMSAuto Net.exe	27
PID 1032 wrote to memory of 1780	1032	SWEfghd678hfjbbhbGFrca.exe	29
PID 1032 wrote to memory of 1780	1032	SWEfghd678hfjbbhbGFrca.exe	29
PID 1032 wrote to memory of 1780	1032	SWEfghd678hfjbbhbGFrca.exe	29
PID 1032 wrote to memory of 1780	1032	SWEfghd678hfjbbhbGFrca.exe	29

C:\Users\Admin\AppData\Local\Temp\KMSAuto Net.exe
"C:\Users\Admin\AppData\Local\Temp\KMSAuto Net.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Roaming\SWEfghd678hfjbbhbGFrca.exe
  "C:\Users\Admin\AppData\Roaming\SWEfghd678hfjbbhbGFrca.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    3⤵
    - Executes dropped EXE
    - Modifies extensions of user files
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\selfdstr.bat" "
  2⤵
  PID:1184

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW_TO_RESTORE_FILES.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2028

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UnpublishUnlock.asp
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-384-0x000007FEF7510000-0x000007FEF778A000-memory.dmp

Filesize
2.5MB

Download
memory/1780-25-0x0000000003480000-0x0000000003491000-memory.dmp

Filesize
68KB

Download
memory/1780-24-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1780-23-0x00000000006BD000-0x00000000006BE000-memory.dmp

Filesize
4KB

Download
memory/1780-26-0x0000000003890000-0x00000000038A1000-memory.dmp

Filesize
68KB

Download
memory/1780-27-0x0000000003480000-0x0000000003491000-memory.dmp

Filesize
68KB

Download
memory/1784-12-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/1784-13-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1784-2-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/2028-382-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads