Overview

overview

10

Static

static

10

ce399a2d07...e6.exe

windows7_x64

1

ce399a2d07...e6.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ce399a2d07c0851164bd8cc9e940b84b88c43ef564846ca654df4abf36c278e6.exe

  • Size

    54KB

  • Sample

    220529-wqtvhsghg2

  • MD5

    12a470956f7437a00d7bcf47f1995ea7

  • SHA1

    7301382916d9f5274a4fb847579f75bc69c9c24b

  • SHA256

    ce399a2d07c0851164bd8cc9e940b84b88c43ef564846ca654df4abf36c278e6

  • SHA512

    3e0ed7030507d076f0578071c9a628aa625ab2bbe0134ad49634d1f72de4ddf42cb02652f6f3b3378ec1e842f109be1cc68334585a46c275c5be3e2d7a685c61

Score
10/10
netwalkerransomwarespywarestealer

Malware Config

Targets

    • Target

      ce399a2d07c0851164bd8cc9e940b84b88c43ef564846ca654df4abf36c278e6.exe

    • Size

      54KB

    • MD5

      12a470956f7437a00d7bcf47f1995ea7

    • SHA1

      7301382916d9f5274a4fb847579f75bc69c9c24b

    • SHA256

      ce399a2d07c0851164bd8cc9e940b84b88c43ef564846ca654df4abf36c278e6

    • SHA512

      3e0ed7030507d076f0578071c9a628aa625ab2bbe0134ad49634d1f72de4ddf42cb02652f6f3b3378ec1e842f109be1cc68334585a46c275c5be3e2d7a685c61

    Score
    8/10
    ransomwarespywarestealer

    • Drops file in Drivers directory

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks