Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 00:55
Behavioral task
behavioral1
Sample
2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe
-
Size
94KB
-
MD5
efeb1be8bd41130cd7c545010d140afa
-
SHA1
a056845be51604a73cac17479f04d9077c202e05
-
SHA256
4fb90e7f4baa933ad69be3abb36dbb586dc86e6162d7ac70a504a0c8942ea798
-
SHA512
291c73ba102104a365c6769b8b29451a3594b06fbe65fe0a8f45d613981bb4ded5e23331ec65148c0a67a90de8fd0cc2c8379909bd2916f1f72cb2ddc68f934a
-
SSDEEP
1536:NQVlCPQRhNs3POdM0ty2XGe0W7Pbk3sPkO5M/Y8fGMNvgaNg:NQ3CPAC/YM0tyAGe0WDPx9MNvg8g
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\Adobe\Acrobat Reader DC\3E4D0-Readme.txt
Family
netwalker
Ransom Note
Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .3e4d0
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Contact us:
[email protected]
[email protected]
Don't forget to include your code in the email:
{code_1b1ea859_3e4d0:
l1o9mo7HVgkq0A2p5TVJ8Ouee3DccU4kFq4YAnpZayNoL9wA2Q
z0Y69n4f0Fxi8JFDfLDiPwXJ/ELA82oijkS7xfr0VMqnUiWage
GyK7n6LDMt/baxdHCQg+g6kS8BHTx6sxfdhfdCzbW2TKQSU74s
WenXiAxVVfTSBUkobJAdirhhyGziixxfLT56hw5YKSeJX9Q79v
/fvFrUMKGbSVQRcF81aoqZsiKyCsP8Ml4pLft1vUrkRDn5lOh1
chucNH1BS4fStYlc2iFJYu7REbu5ANM1g=}
Signatures
-
Detected Netwalker Ransomware 44 IoCs
Detected unpacked Netwalker executable.
resource yara_rule behavioral2/memory/832-0-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/2080-2-0x0000000000580000-0x000000000059B000-memory.dmp netwalker_ransomware behavioral2/memory/2080-3-0x0000000000580000-0x000000000059B000-memory.dmp netwalker_ransomware behavioral2/memory/832-7-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-8-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-9-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-10-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-11-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-12-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-14-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-13-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-15-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-17-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-19-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-20-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-23-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-21-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-24-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-25-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-26-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-28-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-29-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-31-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-33-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-34-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-35-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-36-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-37-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-38-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-48-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-42-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-57-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-61-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-58-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-64-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-65-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-66-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-67-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-70-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-71-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-72-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-77-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-81-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware behavioral2/memory/832-80-0x0000000000E00000-0x0000000000E1B000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (566) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 832 explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3e4d0dbd = "C:\\Program Files (x86)\\3e4d0dbd\\3e4d0dbd.exe" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3908 set thread context of 832 3908 2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe 89 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc explorer.exe File opened for modification C:\Program Files\CloseMount.mpeg2 explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak explorer.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files\ShowInitialize.ttf explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Edge.dat.LOG2 explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\create_form.gif explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt explorer.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt explorer.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Exp_RHP.aapp explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt explorer.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Combine_R_RHP.aapp explorer.exe File created C:\Program Files\dotnet\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt explorer.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md explorer.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak explorer.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api explorer.exe File created C:\Program Files (x86)\3e4d0dbd\3e4d0dbd.exe explorer.exe File opened for modification C:\Program Files\Java\jre-1.8\LICENSE explorer.exe File created C:\Program Files\Java\jre-1.8\lib\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt explorer.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\WordNet_license.txt explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\3E4D0-Readme.txt explorer.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\distribute_form.gif explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt explorer.exe File opened for modification C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB explorer.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json explorer.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\stopwords.ENU explorer.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\en_US.dic explorer.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\cs.pak explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat explorer.exe File opened for modification C:\Program Files\InstallJoin.html explorer.exe File created C:\Program Files\Java\jdk-1.8\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZX______.PFB explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\InAppSign.aapp explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zx______.pfm explorer.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jawt.h explorer.exe File opened for modification C:\Program Files\Java\jdk-1.8\LICENSE explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\UnifiedShare.aapp explorer.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\plugin.X.manifest explorer.exe File opened for modification C:\Program Files\7-Zip\License.txt explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\3E4D0-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef.pak explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4404 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 832 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3908 2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe 832 explorer.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2080 explorer.exe Token: SeBackupPrivilege 228 vssvc.exe Token: SeRestorePrivilege 228 vssvc.exe Token: SeAuditPrivilege 228 vssvc.exe Token: SeDebugPrivilege 832 explorer.exe Token: SeImpersonatePrivilege 832 explorer.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3908 wrote to memory of 832 3908 2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe 89 PID 3908 wrote to memory of 832 3908 2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe 89 PID 3908 wrote to memory of 832 3908 2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe 89 PID 832 wrote to memory of 2080 832 explorer.exe 90 PID 832 wrote to memory of 2080 832 explorer.exe 90 PID 832 wrote to memory of 2080 832 explorer.exe 90 PID 2080 wrote to memory of 4404 2080 explorer.exe 91 PID 2080 wrote to memory of 4404 2080 explorer.exe 91 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-23_efeb1be8bd41130cd7c545010d140afa_babuk_mailto.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"2⤵
- Deletes itself
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:4404
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD537a075f58f8e028ce8ffe3751cb5a67f
SHA159f8f3f3efd849bcb2e32514e42600061c48e0ea
SHA256e9dbe76c6ea15b7ab528df3ae6be53eabd035d19682c6cc0807e23703f63e6bc
SHA51257d3194bdc5d0ac8f2e5e09572aa63b2e29989a33a2ed5de3c0d37580bc90d9b0201ca5919902a3728a6e803f7bf722aa0ace9f685805d91bf149a5403fda909