Analysis
-
max time kernel
93s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-07-2021 12:59
Static task
static1
Behavioral task
behavioral1
Sample
5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe
Resource
win10v20210410
General
-
Target
5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe
-
Size
91KB
-
MD5
b0008e752f488d7e97a8d2452411527e
-
SHA1
56d655932ebbf59bfcc49ca2afc78db16cb7b889
-
SHA256
5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd
-
SHA512
667bca43c63e1602aeb61bcf72eb9dbd86ad42063cebe8dc179a46c5bea723abdaafb75b5713f3cbba5e7e610a85b1c50beb47056250016e79a1b8a03d644bdf
Malware Config
Extracted
C:\3EEE6-Readme.txt
netwalker
2Hamlampampom@cock.li
Galgalgalgalk@tutanota.com
Extracted
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\3EEE6-Readme.txt
netwalker
2Hamlampampom@cock.li
Galgalgalgalk@tutanota.com
Extracted
C:\Program Files\Microsoft Office\root\Integration\3EEE6-Readme.txt
netwalker
2Hamlampampom@cock.li
Galgalgalgalk@tutanota.com
Extracted
C:\Program Files\7-Zip\Lang\3EEE6-Readme.txt
netwalker
2Hamlampampom@cock.li
Galgalgalgalk@tutanota.com
Extracted
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\3EEE6-Readme.txt
netwalker
2Hamlampampom@cock.li
Galgalgalgalk@tutanota.com
Signatures
-
Detected Netwalker Ransomware 2 IoCs
Detected unpacked Netwalker executable.
Processes:
resource yara_rule behavioral2/memory/1200-115-0x0000000003100000-0x000000000311B000-memory.dmp netwalker_ransomware behavioral2/memory/2564-119-0x0000000003020000-0x000000000303B000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
explorer.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ReceiveWait.tiff explorer.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 1200 explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3eee6d1e = "C:\\Program Files (x86)\\3eee6d1e\\3eee6d1e.exe" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exedescription pid process target process PID 3176 set thread context of 1200 3176 5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe explorer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6924_20x20x32.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\3EEE6-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.News\Assets\newsBackground.html explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\3px.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\Icon_Advanced Layout.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page2.jpg explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\nod.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\jfxrt.jar explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008 explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2875_48x48x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-150.png explorer.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\3EEE6-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\HelpIcon_contrast-white.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxSignature.p7x explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-100.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-100.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-black.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreLogo.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-125_contrast-white.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailBadge.scale-150.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\3EEE6-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2875_20x20x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-125.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\nub.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\animations\OneNoteFRE_Welcome.mp4 explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-150_contrast-black.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-focus_32.svg explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-black_scale-125.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-125.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-150.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-black\Square44x44Logo.targetsize-24_altform-unplated.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileSmallSquare.scale-200.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\cash.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Effects\effects_lobby_none.jpg explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-100.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.scale-400.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-100.png explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-36_altform-unplated.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\loc\AppXManifestLoc.16.en-us.xml explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\SkypeLargeTile.scale-200_contrast-black.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10912_40x40x32.png explorer.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\LINEAR_RGB.pf explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\WideTile.scale-100.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\share.svg explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml explorer.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 2576 vssadmin.exe 188 vssadmin.exe 9432 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
explorer.exeexplorer.exepid process 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe 2564 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exeexplorer.exepid process 3176 5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe 1200 explorer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
explorer.exevssvc.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1200 explorer.exe Token: SeBackupPrivilege 3484 vssvc.exe Token: SeRestorePrivilege 3484 vssvc.exe Token: SeAuditPrivilege 3484 vssvc.exe Token: SeDebugPrivilege 2564 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exeexplorer.exeexplorer.exedescription pid process target process PID 3176 wrote to memory of 1200 3176 5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe explorer.exe PID 3176 wrote to memory of 1200 3176 5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe explorer.exe PID 3176 wrote to memory of 1200 3176 5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe explorer.exe PID 1200 wrote to memory of 2576 1200 explorer.exe vssadmin.exe PID 1200 wrote to memory of 2576 1200 explorer.exe vssadmin.exe PID 1200 wrote to memory of 2564 1200 explorer.exe explorer.exe PID 1200 wrote to memory of 2564 1200 explorer.exe explorer.exe PID 1200 wrote to memory of 2564 1200 explorer.exe explorer.exe PID 2564 wrote to memory of 188 2564 explorer.exe vssadmin.exe PID 2564 wrote to memory of 188 2564 explorer.exe vssadmin.exe PID 1200 wrote to memory of 9400 1200 explorer.exe notepad.exe PID 1200 wrote to memory of 9400 1200 explorer.exe notepad.exe PID 1200 wrote to memory of 9400 1200 explorer.exe notepad.exe PID 1200 wrote to memory of 9432 1200 explorer.exe vssadmin.exe PID 1200 wrote to memory of 9432 1200 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe"C:\Users\Admin\AppData\Local\Temp\5e03e3d93a456405952cdadee3018043789f118b871b93d113ce371c079f19dd.sample.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"2⤵
- Modifies extensions of user files
- Deletes itself
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe C:\Users\Admin\Desktop\3EEE6-Readme.txt3⤵
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\3EEE6-Readme.txtMD5
b909af4cc5deb109861c8d8b487b7756
SHA1c5ca907b0c364234623d9bc547223c1848e64ea4
SHA256a8cb1d4dfd03cef2baac93537f280ccae1240aaf0316ac17cfda56f365197892
SHA5122c4e9b5cc3001aed432136dbcb43d69a0e0f68d6243a4ecaff0c47fad1b5bf0efc20aca89fefbb918eeb794323c7352fffce2d595b3c2d54debab7425d5ee50b
-
memory/188-118-0x0000000000000000-mapping.dmp
-
memory/1200-114-0x0000000000000000-mapping.dmp
-
memory/1200-115-0x0000000003100000-0x000000000311B000-memory.dmpFilesize
108KB
-
memory/2564-117-0x0000000000000000-mapping.dmp
-
memory/2564-119-0x0000000003020000-0x000000000303B000-memory.dmpFilesize
108KB
-
memory/2576-116-0x0000000000000000-mapping.dmp
-
memory/9400-120-0x0000000000000000-mapping.dmp
-
memory/9432-121-0x0000000000000000-mapping.dmp