Analysis
-
max time kernel
2s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
12-06-2021 22:53
Static task
static1
Behavioral task
behavioral1
Sample
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe
Resource
win10v20210410
General
-
Target
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe
-
Size
3.3MB
-
MD5
1341f07df1c2c4841f1b0dc6641676f7
-
SHA1
9aedf3b45bb430358aefb81fb15ea93387d47436
-
SHA256
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c
-
SHA512
eab98a1a6632ce3cd940e219c218ec9704469aafe9bf5817a5397351cdf18a25dc69544d7051b416f46e4a1da74c3ef39f6a9750181084f522f9c876a54a0626
Malware Config
Extracted
C:\$Recycle.Bin\NEFILIM-HELP.txt
http://corpleaks.net
http://hxt254aygrsziejn.onion
Signatures
-
Nefilim
Ransomware first seen in early 2020 which shares code with the Nemty family. Rewritten in Golang in July 2020.
-
Drops desktop.ini file(s) 8 IoCs
Processes:
2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini 2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2d4b2b807ace9dfc3f13962c65f1b6b9b6ba80394c517729ada50d6302792d9c.bin.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
066ecbc89167f56503fbf2b4bc5f22de
SHA1d538c251e4153abcab0caadc6fc5f075bab74f11
SHA25688b96292234b61f6dfb5ad0738b6c5f2e9a4f37d040a0a08edea2314e0a86e5f
SHA512011b07f80750a2112cec4a8f2e114b38cec5cdcf1c758bb6b66951b3e749d917d96cba3c1b3cc0c8616c3dbad4c546d80da056014ace6b9c66326b98e4b02267