General

  • Target

    RNSM00399.7z

  • Size

    33.1MB

  • Sample

    241031-ze99xatdpl

  • MD5

    846e189b61eff1e4b2107586b721d0a9

  • SHA1

    a17ad7404737bdf6b162ed7e2c035161da6bfb4f

  • SHA256

    458caa60b5fbf91bdaf60eea708fa2e5660772180b721a153e2bf6b3f6c5b88f

  • SHA512

    5cb49458c8918572e861cc602fd6adc1c49b0658dfbb8ed33773216f4ccc8b3139c8d800d7e97e9ebc77e1339ea4a4d6553d2d16e30367018b0936e67d64431e

  • SSDEEP

    786432:bxDypf4kaZp1bwM3bcywK7tgIpWzTjdspli3YyZEz1PIYU:YpIp5zwK7tgIpWzviz1g5

Malware Config

Extracted

Family

crimsonrat

C2

64.188.12.126

Extracted

Path

C:\Users\Public\Documents\!!!_READ_ME_C193238C_!!!.txt

Ransom Note
*************************************************************************************************************** HELLO CAPCOM ! If you reading this message, it means your network was PENETRATED and all of your files and data has been ENCRYPTED by R A G N A R L O C K E R ! *************************************************************************************************************** *YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL* (contact information you will find at the bottom of this notes) !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT Use any third-party or public Decryption software, it also may DAMAGE files. DO NOT Shutdown or Reset your system, it can DAMAGE files ------------------------------------- There is ONLY ONE possible way to get back your files - contact us via LIVE CHAT and pay for the special DECRYPTION KEY ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, to show that it Works. Don't waste your TIME, the link for contact us will be deleted if there is no contact made in closest time and you will NEVER restore your DATA. !!! HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. ! WARNING ! ! Whole your International Corporate Network was fully COMPROMISED ! We have BREACHED your security perimeter and get access to every server of company's Network in different offices located in Japan, USA, Canada. So we has DOWNLOADED more than 1TB total volume of your PRIVATE SENSITIVE Data, including: -Accounting files, Banking Statements, Budget and Revenue files classified as Confidential, Tax Documents -Intellectual Property, Proprietary Business information, Clients and Employees Personal information (Such as Passports and Visa), Incidents Acts -Corporate Agreements and Contracts, Non-Disclosure Agreements, Confidential Agreements, Sales Summaries -Also we have your Private Corporate Correspondence, Emails and Messanger Conversations, Marketing presentations, Audit reports and a lot of other Sensitive Information If NO Deal made than all your Data will be Published and/or Sold through an auction to any third-parties - There are some screenshots just as a proofs of what we got on you. (you can find more on Temporary Leak Page) Screenshots: https://prnt.sc/vb3g0f https://prnt.sc/vb3hg9 https://prnt.sc/vb3hqd https://prnt.sc/vb3iuj https://prnt.sc/vb3j7c https://prnt.sc/vb3m3t https://prnt.sc/vb3pia ------------------------------------- Whole data that gathered from your private file-servers and directories could be SOLD to any third-parties and/or PUBLISHED in MASS MEDIA for BREAKING NEWS! Yours partners, clients and investors would be notified about the LEAK, the consequences of LEAK will have a DISASTROUS effect on your company's stock index and reputation. So better contact us ASAP to resolve this issue. If we make a Deal everything would be kept in Secret and all your Data will be Restored, so it is much cheaper and easier way for you to make deal with us, than to pay lawsuit expenses. You can take a look for some more examples of what we have, right now it's a private, temporary and hidden page. But it could be supplemented and become permanent and accessable for Public View if you decide NOT pay. Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/?068vV05uS2GCgqa To view the page's content use password: cVnImQthX5 ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://rgnar43spcnsocswaw22lmk7jnget5f6vow7kqmnf4jc6hfwpiwoajid.onion/client/?FB5dDAEC6F63aA6cd5D52B8822e2Eb0278aDCCEE8E7592f379ed00Ac14fD16cc c) To visit TEMPORARY LEAK PAGE with your data on our News Blog, open this website : http://p6o7m73ujalhgkiv.onion/?068vV05uS2GCgqa ( password: cVnImQthX5 ) d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---BEGIN RAGN KEY--- RkI1ZERBRUM2RjYzYUE2Y2Q1RDUyQjg4MjJlMkViMDI3OGFEQ0NFRThFNzU5MmYzNzllZDAwQWMxNGZEMTZjYw== ---END RAGN KEY--- ***********************************************************************************
URLs

https://prnt.sc/vb3g0f

https://prnt.sc/vb3hg9

https://prnt.sc/vb3hqd

https://prnt.sc/vb3iuj

https://prnt.sc/vb3j7c

https://prnt.sc/vb3m3t

https://prnt.sc/vb3pia

http://p6o7m73ujalhgkiv.onion/?068vV05uS2GCgqa

http://rgnar43spcnsocswaw22lmk7jnget5f6vow7kqmnf4jc6hfwpiwoajid.onion/client/?FB5dDAEC6F63aA6cd5D52B8822e2Eb0278aDCCEE8E7592f379ed00Ac14fD16cc

Targets

    • Target

      RNSM00399.7z

    • Size

      33.1MB

    • MD5

      846e189b61eff1e4b2107586b721d0a9

    • SHA1

      a17ad7404737bdf6b162ed7e2c035161da6bfb4f

    • SHA256

      458caa60b5fbf91bdaf60eea708fa2e5660772180b721a153e2bf6b3f6c5b88f

    • SHA512

      5cb49458c8918572e861cc602fd6adc1c49b0658dfbb8ed33773216f4ccc8b3139c8d800d7e97e9ebc77e1339ea4a4d6553d2d16e30367018b0936e67d64431e

    • SSDEEP

      786432:bxDypf4kaZp1bwM3bcywK7tgIpWzTjdspli3YyZEz1PIYU:YpIp5zwK7tgIpWzviz1g5

    • CrimsonRAT main payload

    • CrimsonRat

      Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    • Crimsonrat family

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

    • Dharma family

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Renames multiple (523) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks