de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d
de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe
94KB
31-08-2021 11:44
993b73d6490bc5a7e23e02210b317247
6fd314af34409e945504e166eb8cd88127c1070e
de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d
Extracted
Path | C:\Program Files\Microsoft Office\Office14\64EEB-Readme.txt |
Family | netwalker |
Ransom Note |
Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .64eeb
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Contact us:
1.knoocknoo@cock.li
2.eeeooppaaaxxx@tuta.io
Don't forget to include your code in the email:
{code_1b1ea859_64eeb:
oMH56M9avCLh6grRFhL604rTmpos46suiylBLhoiKV2Zr4n0bm
pQSddEA3Qk7M6IbH7jby3PsTlFqRmQGgBeFSXwnm3WX38eWage
G8QcMcndUm30ttR5mTCr2EcsHV5HeRiFVqdH4gEkJw2SfZwJHv
rKQVU5UE6UacmwJvc7gmpLQSsp7aG13puYGCJfO9W5ICPwtYrb
szQgQEHNmN7BxtRaruat8g/po8uOdyl7YFxCOWmdSMkUhvjQGE
m28BcEq9dhR7NKeVIVxHkt4ylvXVVr6KI=}
|
Emails |
knoocknoo@cock.li eeeooppaaaxxx@tuta.io |
Extracted
Path | C:\Program Files\7-Zip\Lang\64EEB-Readme.txt |
Family | netwalker |
Ransom Note |
Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .64eeb
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Contact us:
1.knoocknoo@cock.li
2.eeeooppaaaxxx@tuta.io
Don't forget to include your code in the email:
{code_1b1ea859_64eeb:
oMH56M9avCLh6grRFhL604rTmpos46suiylBLhoiKV2Zr4n0bm
pQSddEA3Qk7M6IbH7jby3PsTlFqRmQGgBeFSXwnm3WX38eWage
G8QcMcndUm30ttR5mTCr2EcsHV5HeRiFVqdH4gEkJw2SfZwJHv
rKQVU5UE6UacmwJvc7gmpLQSsp7aG13puYGCJfO9W5ICPwtYrb
szQgQEHNmN7BxtRaruat8g/po8uOdyl7YFxCOWmdSMkUhvjQGE
m28BcEq9dhR7NKeVIVxHkt4ylvXVVr6KI=}Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .64eeb
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Contact us:
1.knoocknoo@cock.li
2.eeeooppaaaxxx@tuta.io
Don't forget to include your code in the email:
{code_1b1ea859_64eeb:
oMH56M9avCLh6grRFhL604rTmpos46suiylBLhoiKV2Zr4n0bm
pQSddEA3Qk7M6IbH7jby3PsTlFqRmQGgBeFSXwnm3WX38eWage
G8QcMcndUm30ttR5mTCr2EcsHV5HeRiFVqdH4gEkJw2SfZwJHv
rKQVU5UE6UacmwJvc7gmpLQSsp7aG13puYGCJfO9W5ICPwtYrb
szQgQEHNmN7BxtRaruat8g/po8uOdyl7YFxCOWmdSMkUhvjQGE
m28BcEq9dhR7NKeVIVxHkt4ylvXVVr6KI=}
|
Emails |
knoocknoo@cock.li eeeooppaaaxxx@tuta.io |
Filter: none
-
Detected Netwalker Ransomware
Description
Detected unpacked Netwalker executable.
Reported IOCs
resource yara_rule behavioral1/memory/2024-68-0x0000000000080000-0x000000000009B000-memory.dmp netwalker_ransomware behavioral1/memory/2044-69-0x0000000000080000-0x000000000009B000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Description
Ransomware family with multiple versions. Also known as MailTo.
Tags
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Modifies extensions of user filesexplorer.exe
Description
Ransomware generally changes the extension on encrypted files.
Tags
Reported IOCs
description ioc process File opened for modification C:\Users\Admin\Pictures\PushProtect.tiff explorer.exe -
Deletes itselfexplorer.exe
Reported IOCs
pid process 2024 explorer.exe -
Adds Run key to start applicationexplorer.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\64eeb938 = "C:\\Program Files (x86)\\64eeb938\\64eeb938.exe" explorer.exe -
Suspicious use of SetThreadContextde04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exeexplorer.exe
Reported IOCs
description pid process target process PID 1652 set thread context of 2024 1652 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe explorer.exe PID 2024 set thread context of 2044 2024 explorer.exe explorer.exe -
Drops file in Program Files directoryexplorer.exe
Reported IOCs
description ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115868.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00693_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Clarity.xml explorer.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hu.pak explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285822.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SegoeChess.ttf explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.LEX explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OMML2MML.XSL explorer.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\64EEB-Readme.txt explorer.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\64EEB-Readme.txt explorer.exe File created C:\Program Files\64EEB-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_COL.HXT explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01586_.WMF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml explorer.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\de.pak explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Antigua explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman explorer.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\digest.s explorer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\64EEB-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImages.jpg explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\security\local_policy.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287415.WMF explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Easter explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-execution.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00814_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART1.BDR explorer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\64EEB-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_F_COL.HXK explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_off.gif explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18247_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107146.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185776.WMF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00452_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right.gif explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18221_.WMF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198020.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10266_.GIF explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Chagos explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7ES.LEX explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15169_.GIF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_center.gif explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\IntroducingPowerPoint2010.potx explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GREETING.DPV explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\custom.lua explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBLINK.POC explorer.exe -
Interacts with shadow copiesvssadmin.exevssadmin.exe
Description
Shadow copies are often targeted by ransomware to inhibit system recovery.
Tags
TTPs
Reported IOCs
pid process 1172 vssadmin.exe 5348 vssadmin.exe -
Suspicious behavior: EnumeratesProcessesexplorer.exeexplorer.exe
Reported IOCs
pid process 2024 explorer.exe 2024 explorer.exe 2024 explorer.exe 2024 explorer.exe 2024 explorer.exe 2024 explorer.exe 2024 explorer.exe 2024 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe 2044 explorer.exe -
Suspicious behavior: MapViewOfSectionde04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exeexplorer.exe
Reported IOCs
pid process 1652 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe 2024 explorer.exe -
Suspicious use of AdjustPrivilegeTokenexplorer.exevssvc.exeexplorer.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 2044 explorer.exe Token: SeBackupPrivilege 268 vssvc.exe Token: SeRestorePrivilege 268 vssvc.exe Token: SeAuditPrivilege 268 vssvc.exe Token: SeDebugPrivilege 2024 explorer.exe Token: SeImpersonatePrivilege 2024 explorer.exe -
Suspicious use of WriteProcessMemoryde04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exeexplorer.exeexplorer.exe
Reported IOCs
description pid process target process PID 1652 wrote to memory of 2024 1652 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe explorer.exe PID 1652 wrote to memory of 2024 1652 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe explorer.exe PID 1652 wrote to memory of 2024 1652 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe explorer.exe PID 1652 wrote to memory of 2024 1652 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe explorer.exe PID 2024 wrote to memory of 2044 2024 explorer.exe explorer.exe PID 2024 wrote to memory of 2044 2024 explorer.exe explorer.exe PID 2024 wrote to memory of 2044 2024 explorer.exe explorer.exe PID 2024 wrote to memory of 2044 2024 explorer.exe explorer.exe PID 2044 wrote to memory of 1172 2044 explorer.exe vssadmin.exe PID 2044 wrote to memory of 1172 2044 explorer.exe vssadmin.exe PID 2044 wrote to memory of 1172 2044 explorer.exe vssadmin.exe PID 2044 wrote to memory of 1172 2044 explorer.exe vssadmin.exe PID 2024 wrote to memory of 5304 2024 explorer.exe notepad.exe PID 2024 wrote to memory of 5304 2024 explorer.exe notepad.exe PID 2024 wrote to memory of 5304 2024 explorer.exe notepad.exe PID 2024 wrote to memory of 5304 2024 explorer.exe notepad.exe PID 2024 wrote to memory of 5348 2024 explorer.exe vssadmin.exe PID 2024 wrote to memory of 5348 2024 explorer.exe vssadmin.exe PID 2024 wrote to memory of 5348 2024 explorer.exe vssadmin.exe PID 2024 wrote to memory of 5348 2024 explorer.exe vssadmin.exe
-
C:\Users\Admin\AppData\Local\Temp\de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe"C:\Users\Admin\AppData\Local\Temp\de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe"Suspicious use of SetThreadContextSuspicious behavior: MapViewOfSectionSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"Modifies extensions of user filesDeletes itselfAdds Run key to start applicationSuspicious use of SetThreadContextDrops file in Program Files directorySuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quietInteracts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\64EEB-Readme.txt"
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quietInteracts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\64EEB-Readme.txt
MD5706a12b01469bbab745b7f448708118b
SHA1ba5c5b0625424eb5d8b98fe7a016d1292a6e2ab0
SHA25617d0a81b10a6954dae6532efa5588d5065033ba1ad59b5c2170a0816da7b438d
SHA512ab0c752ea1b9d78b069b1ec12f11db1b69f52ad410267411f2f30de9f26199619489176dfbf02969346f08b9b7ea4d82b54c40121849ba2ef2003388b80481fc
-
memory/1172-67-0x0000000000000000-mapping.dmp
-
memory/1652-60-0x0000000076E11000-0x0000000076E13000-memory.dmp
-
memory/2024-61-0x0000000000000000-mapping.dmp
-
memory/2024-68-0x0000000000080000-0x000000000009B000-memory.dmp
-
memory/2024-63-0x0000000075451000-0x0000000075453000-memory.dmp
-
memory/2044-64-0x0000000000000000-mapping.dmp
-
memory/2044-69-0x0000000000080000-0x000000000009B000-memory.dmp
-
memory/5304-70-0x0000000000000000-mapping.dmp
-
memory/5348-73-0x0000000000000000-mapping.dmp