Analysis
-
max time kernel
152s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 01:36
Static task
static1
Behavioral task
behavioral1
Sample
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b.dll
Resource
win10v2004-en-20220113
General
-
Target
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b.dll
-
Size
57KB
-
MD5
45b39459e41bb09ed56e39fbcc7f2874
-
SHA1
07585e91f43cfce131769861fe81d075ee0d6673
-
SHA256
121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b
-
SHA512
7732e41aace89cfbe1ee4deaf2f6b08ff627bec92cba651d920a33a4f0741afda2f72cffbc53cc0997e9846d39b800b8a649eba826393db554c586f97af1828c
Malware Config
Extracted
C:\Users\Admin\0AD26D-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ExportSearch.tiff rundll32.exe File opened for modification C:\Users\Admin\Pictures\InstallUnregister.tiff rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\RELAY.CER rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Newsprint.thmx rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14882_.GIF rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OMML2MML.XSL rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV.HXS rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\0AD26D-Readme.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB01741L.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10297_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\sound.properties rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\0AD26D-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\ANALYS32.XLL rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac rundll32.exe File opened for modification C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apex.thmx rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL095.XML rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif rundll32.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\0AD26D-Readme.txt rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\0AD26D-Readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCHUR98.POC rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL022.XML rundll32.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\0AD26D-Readme.txt rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\0AD26D-Readme.txt rundll32.exe File created C:\Program Files\Java\jdk1.7.0_80\0AD26D-Readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\security\blacklist rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZUSR12.ACCDU rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251925.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyReport.dotx rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMWIN.FAE rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\TURABIAN.XSL rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14529_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199283.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Clarity.thmx rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pl.pak rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Messenger.xml rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\0AD26D-Readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVCMP.DIC rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CHIMES.WAV rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18187_.WMF rundll32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
rundll32.exepid process 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe 1332 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 1332 rundll32.exe Token: SeImpersonatePrivilege 1332 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1700 wrote to memory of 1332 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1332 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1332 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1332 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1332 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1332 1700 rundll32.exe rundll32.exe PID 1700 wrote to memory of 1332 1700 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\121c1d8a3e2a55f1ca67e6baf55648528e9025fef8ea93e1922f116ea7220d6b.dll,#12⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1332-55-0x0000000075F91000-0x0000000075F93000-memory.dmpFilesize
8KB