Overview

overview

10

Static

static

1

RNSM00344.7z

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RNSM00344.7z

  • Size

    9.2MB

  • Sample

    241110-vgvj1szqby

  • MD5

    2fedb70cf5b5387599c79c2a2785e00d

  • SHA1

    0e4fe1eb453d930ee3950c969ddcf10bdf841187

  • SHA256

    b001eb3fc9a1569375c52ad71f75483b3f7a5d0b9b6d78a6493729cadc05d74b

  • SHA512

    2ec43337122ef0026dcc3a47bc179dbf7bdb4ce2e05d2c55f8bc1bbd77c8195cbe9d41d1d7a7412dcc7e9111cd2719778a16f60302d9ac1e240649f2d577d5cc

  • SSDEEP

    196608:TUI11pp1nVovwjMrLzmiF/oreRWX0ZTbQugpwANCUG+Z:RDpPVovwjMrPFdoreRWX0ZTbQ/CUlZ

Score
10/10
dharmaglobeimposternanocorevidarxpertrat10/18credential_accessdefense_evasiondiscoveryevasionexecutionimpactkeyloggerpersistenceprivilege_escalationransomwareratspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

hangulcoxpw.pw:4003

securefbi.ddns.net:4003
Mutex

ef9cbd86-f3d1-405e-b5e1-df86325ab516

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    securefbi.ddns.net

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2018-08-05T09:04:02.038587836Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    4003

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    ef9cbd86-f3d1-405e-b5e1-df86325ab516

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    hangulcoxpw.pw

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

vidar

C2

http://montemon.com/

Extracted

Family

xpertrat

Version

3.1.9

Botnet

10/18

C2

nl-amsterdam.ra4wvpn.com:8585

hikari.sakananoko.io:8585

nozomi.sakananoko.io:8585
Mutex

A6F228P5-F8G1-F1T6-B1X3-I7P6I4R8F6F5

Extracted

Path

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\[HOW_TO_DECRYPT_FILES].html

Ransom Note
<html> <head> <title>How can I recover my files ?</title> <style> html, body { font-family: lucida sans,tahoma,aerial,serif; font-size: 14px; overflow-x: hidden; background-color: #fff; padding-left: 1rem; } div.box { border: 1px dotted #212121; padding: 0.4rem; display: block; margin-top: 0.5rem; margin-bottom: 0.5rem; } input[type=submit] { border: none; padding: 0.1rem 0.7rem 0.1rem 0.7rem; background-color: #303f9f; color: #fff; } input[type=submit]:hover { background-color: #212121; } a { color: #212121; text-decoration: none; font-weight: bold; } a:hover { color: #3f51b5; text-decoration: underline; } </style> </head> <body onload="submit_form()"> <div style="margin: auto; max-width: 750px; padding: .5rem 1.5rem .5rem 1.5rem;"> <h3>What happened to my files ?</h3> <p> All of your important files were encrypted using a combination of <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Public-key_cryptography">RSA-2048</a> and <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard">AES-256</a>. </p> <h3>What does this mean ?</h3> <p> This means that your files were modified in a way that makes working with them impossible, unless you have the keys to decrypt them. </p> <h3>Is it possible to recover my files ?</h3> <p> Yes, it possible to get your files back, you'll need a special program (decryptor) and the private key of the key pair used to encrypt them. </p> <h3>How can I get the decryptor and the private key ?</h3> <p> First, you'll need to synchronize your machine with our site, you can do this by clicking the button "Upload the KEY file". You can also manually upload the synchronization file <span style="border: 1px dotted #212121;padding: 0.1rem 0.3rem 0.1rem 0.3rem;">C:\Users\Public\Desktop\KEY</span> by visiting any of the links below. <span style="display: block; font-size: 0.8rem;">*This file contains information to identify your machine and the keys used to encrypt your files. However, those keys are encrypted and only our server can decrypt them.</span> </p> <p> After you've synchronized your machine with our server, you'll just need to follow the instructions there on how to pay for the decryption of your files. </p> <div style="text-align: center;padding-top: 0.5rem; padding-bottom: 0.5rem;"> <form id="infection_form" action="http://lockerrwhuaf2jjx.onion.sx" method="POST"> <input type="hidden" name="infection" value="fJjtX54GAACgBgAA4wrqStTvh/Q8w0gcynGc/3sdxr7iY63kOkJ/rRB2PMPX/SUtwVLcNAuC3maZWM9NPbxDQtM8RXfzf1EUFFmBYIIWFGZ99vyTivV/Y99cxgAo3NClhD4J7jgRPMrIFf7EdH4tvh8Vjq8TFKDIb76AFQPUNmK+rqLJ/G/gTx9x7hD9pq8AU2xtGihyBpkyAbuN1LgNGOHzDrfbmHY7Jv6OK2gKQ346x6oYMMZCGjZJ4D1F2mwfQ94b8GgCAdok28CzfiIAIDd8JiNETJzOpHdhnjmTAd0AiQihoFBzXnRB6b6jJFdFk7k/WI7Kp1b14/8GOKCNHhWqdBEEmQtRApKDNOW/ZoeSwPnPRUmSLmbYZKi4kXwIA3WkHh+ik3k0+kJK9FmVVUAmkvXFEyfH9tSaFCCNs2mrtreOougIBza1Uex2pAosRiYBczfe9w4+3UTVRwKCNrNSfjkjoY+ifmn2sy7sTO/oSro8O2aVE7cd89ZJkGZBfynD1HOFLGGzkEzY0nYablxv+/f7ko3OMUcyJQUC8qJdTujcmYZ49C4uZnQrRHt3bJ+RLOQFoikZlsQsFq8udAYKuZcuXOKhHk+3dbDLnEwfY5GXcvRA9QXRQA4Yq9dv3T4IIr+hBlFAws6lHWAXWtGWtWKfEYv7/aAstgtp97W+BAq2OFaBPe5W575d93VuuQqyoxv2YAUshuXX3ibFd5bRTib/nSOIukS56Y8EDMOBnILkRysC7z/pN+kP9LYs2IacnIfe84eSK1UQ6NZgqXl9D1Yc0UhW/Z8NAAVM/DHOjg6tlR5xqHx9Ux0UWC8/+1obySrULCDzIap7oa71rO4KCGd+VKVFpaSCxA49rQApqBhFcH47VDqOb4a+11hWU6gWVCESXPBYqVkZIuQTssOqKgz6NhQA1n90A13XVASqX4HuFBA2QL0f9djLEFfIR7Mu17ZPjoqI4ML/P+e7G9TlG4JseMM9nCu/k1i4y/zOobT63uG2rDVbnY514y+YLy4d8hlCU8Ik49GjH2Gn+ftM3knpnS8/erCl2ftKj4da9q2waVZszgrJ6vPtuYc7ODUXYH4BCQT+qPM2b4L+z3U90Fiu3D1XD9twv00cp/zOfpcHdL5corUiqRkoYbNZAEc3xGthJmhGtHlNYsVKfY1gwgotevyZyeqpilAwo2gRKJwKEnx3K/0KqiYFT//QYrAMw9Qb0gZu6pH/5wYM533s6/TlBqrlGfgZYXP7s94rjU12TsB+vqQKaWVD8P6HTwkZtR/F0MhJ0oPvbeDudMUSp3I659CFrP4T9S2MA+ToH/RXqJuRkAQIJ895ux7EnZ6CBlz8idOeix4WnJb5JqjUsm7V6eOujegAQUErSiqXG59rmjsqtucYdPRWpHRiehnSEoOiFpfBhq6Cu30H6tKrslv1kFY/pRGv1REEuSwnYJBpy79Ip3xmbB08Yzs0KFYzGnjc+QBo/lFB809On1zKsTRegH9UgnaSaHXSg9Qn+BessrSyqCKzqu3BteA1q4F6BToe7nIXXSqecECgA+Eh0vz7+TKv273okQmfeLeIYg83FFbZHi/QPJMpqC/vnHDYcmREikSOpUXW5nxGu2c7JhGPDz5c22IIsiXuoL47Do4T3T61qDvNlpNeunH6FGybMdlvxt70LnAEnGgjH1qGeIoSyGovXW/MN8WZ0TjAwya4WHIAIfSIH2k6qzCDFcbjVunndU3Sf+KW2ADYmDHCLYoHHjgFvZqywrp4/Vk90gB3AyXFpiO58SVgLqGASraecvfKM6xVKIIOuF5yPT8O/yIJ9uZylZqImO44Zf+SF/UsupvUjYxtpGuKgsywDRqIt4kf2Dbn47dLgJBCAJ+rAPWA4u3+XMmLKzvfcUpofWPrblUeL6f9tJOl//pZ/zs69cs5y8mb5YWjFIIE20UNVS5qzRWeor2b+SPpqis/Xf10rIz2jEUNygnZJTXEyq0b37GYwhxCCjb/hBIep996OzeRmQ+omO0C7QH8w10AX7xVF1xS53NRzOWtX2au/HzYDkxj4+BD2QPG/lvknF4KMrhQOXj7b7FlH0tCmbsF/1co6tuwsgk5itwBw1cPTS7Z1ffe0k0zwqKTuff12+Ee8dBBWbFQXNI0bGHA+lVE0hgkJgcBZ9m3g7UGvtf5yIeYtgmYAt0YLTqyYH4mu5ur1OmPkUP9cjHlqNjnG0tZNnT/nmWOsF1mLz70iMTJAH4Efq12fNOb9xkWnsMcuJDkVlCpv1iirHWPYozUx+DRPa8gLC4u+0sgzlccH/3Y/h4vMOC5uGvpmEA20mjbpQoSr4EQtXefSCZnEnv1mmeX4rfBPDLozkSHDYR5fa3PnUElUUf6929b+4Yt8eeeCjQ1oI0OeiRcax3rndUG2YFzbULCpL0ZTGmWUgKrxcZAU3g5LoPx2QDavzj1FnU+ZMQQN/KPwDZb9c4ZnURSpg7OJSk/4D8BPE86A543I5wqqIPlve+EpssAkOYZEPqSG2fsFmb7QgO/Ro/DitDy2xETw8Lc3h2gwMfifenr2OEzoOBBIhq1QgpbrxZSlFp+9Uz4zcf3qHRmF0hTmMgII9WGnp/7MIPfMEejcTO3luuBgpek7xG2OyLwp9EIRkU5OOcnZ+lmrQpcoXmQJ/9oKUEFg19SYaV8zVU6xv4N4XcMFGJ5nOCv8GAUie4oBkJ+r420ZsuLvLlO4SwOKV/boNlwJxZHJwvGi5eh6fVNzyFdTm7oi1yLsI2c/xHR1XKw5qBgGgkkcyAJWpNAHs4f4L89aa8p3qKEEL4i3jEe+8LNaiBS3u7ePBtPZ5NAM8VRDuMv+0iwfs1lFGmKN03/2EWDziomcs/CsLwtxTN7UeAN1jhVAqiMEs9j5A+HeqtYXZjG4q0hVn78eXcANo7MIGi0o8OKZhKOV9EjXj5/DkRoFD+9WJaABzOKUtNUP/dtfVDHkpRzKiV04gDlQVBuTeF5O/8GbdKEFE39P8DycNcPagbZymooJDZPIyaRpvBhwaCrpFkbZwyVFMa3jEqMt7HYN5HBU2BOHF2DWQOofisYq26gizI8TsKvTCrmJn67+XqELpjeYZ1panveFyNxIRRiJjtHse4Ng0bHeUMzPlLXIcHMU2c0LfdwpuYwtlcK65yfaYGBHs07QqXRPiJXalMsQN3axv9kbBVYxgkj6jaPeZF0QKL8U7fAVYL/lFGgWINS9uOH3pU+sVMG4CQd6cpj+wXY7fVoTY/g+DVEyBjjNhad1i2Xf2DSeZbgxyeyTI/wqDOvGdsOyrlSA5z0YyVTc87ndr8AJ5o1z9Kq5nWD4Zb99xWNNg8Ptp6619JVTkmzmCfkUKHwn/H/pHpznO/7RgOjjKRiH38y8LdWJqT5jWjMt4okzXpXoe1UWJ4Wv8etJohr4S2cnm1tDnNSGPTbIQQPASynF/yBm+vLgW/eexqig2MFp1k31uB/R/mZl0F0aXiP2X6Xo0lf4VkrZGduHwnQUbbFa9RcFwxoGCenDU3F2+gcno6udPvFU1/PEAW1HeYCauz96G3iS3o2p6aLzJhaxNeeZjYe7P+Ny9CCf4B/39K/u2KzXbuTEXeyB84EEUJRebD497XOw9NgX9HwEWsugHzdWymOkkrUojMgyvXQTv8AHe1bLc4svxNLSCEHnppfa8I1BbxNoB/06xlQ/WEcgicSTHb3AOmCdi+lYuQIphrXhVOg7M8s0eklqoNZxcRj3K7zCXyJziP6cNzPGNNMCww7RBsZY/jeIGPLgyz2sKxVIJyhKLF/8XBjgx7LIx1dLjP+3q81NLgj7vYCgn5b+6xAgSCq5Z+RuqlSgoiOnlmBEA=="> <noscript><span style="color: red; font-weight: bold;">Javascript is disabled! You must click the button below or manually upload the KEY file.</span></noscript> <input type="submit" value="Upload the KEY file"> </form> </div> <div class="box"> <p> Instructions to install Tor Browser (recommended). </p> <hr> <ol> <li>Download the Tor Browser Bundle here: <a rel="noreferrer" href="https://www.torproject.org/download/download-easy.html.en#windows">https://www.torproject.org</a>.</li> <li>Execute the file you downloaded to extract the Tor Browser into a folder on your computer.</li> <li>Then simply open the folder and click on "Start Tor Browser".</li> <li>Copy and paste the onion address into the address bar:<br><br><span style="border: 1px dotted #212121;padding: 0.15rem 0.3rem 0.15rem 0.3rem;">http://lockerrwhuaf2jjx.onion/NNYJZAHP_BA887275D0CD2F5E6522DF69/</span></li> </ol> </div> <div class="box"> <p style="text-align: center; color: red;"> Although it is not recommended to use web proxies to access the website, you can use the links below with a normal browser to access your page. Just remember to use the Tor Browser whenever making a payment. WARNING: The links below do not belong to us, they all go through someone else's server and should be avoided whenever possible. </p> <ol> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.sx/NNYJZAHP_BA887275D0CD2F5E6522DF69/">http://lockerrwhuaf2jjx.onion.sx/NNYJZAHP_BA887275D0CD2F5E6522DF69/</a></li> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.link/NNYJZAHP_BA887275D0CD2F5E6522DF69/">http://lockerrwhuaf2jjx.onion.link/NNYJZAHP_BA887275D0CD2F5E6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.rip/NNYJZAHP_BA887275D0CD2F5E6522DF69/">https://lockerrwhuaf2jjx.onion.rip/NNYJZAHP_BA887275D0CD2F5E6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.to/NNYJZAHP_BA887275D0CD2F5E6522DF69/">https://lockerrwhuaf2jjx.onion.to/NNYJZAHP_BA887275D0CD2F5E6522DF69/</a></li> </ol> </div> </div> </body> <script> function submit_form() { if (confirm('Do you want the KEY file to be automatically uploaded ?')) { document.infection_form.submit(); } } </script> </html>

Targets

    • Target

      RNSM00344.7z

    • Size

      9.2MB

    • MD5

      2fedb70cf5b5387599c79c2a2785e00d

    • SHA1

      0e4fe1eb453d930ee3950c969ddcf10bdf841187

    • SHA256

      b001eb3fc9a1569375c52ad71f75483b3f7a5d0b9b6d78a6493729cadc05d74b

    • SHA512

      2ec43337122ef0026dcc3a47bc179dbf7bdb4ce2e05d2c55f8bc1bbd77c8195cbe9d41d1d7a7412dcc7e9111cd2719778a16f60302d9ac1e240649f2d577d5cc

    • SSDEEP

      196608:TUI11pp1nVovwjMrLzmiF/oreRWX0ZTbQugpwANCUG+Z:RDpPVovwjMrPFdoreRWX0ZTbQ/CUlZ

    Score
    10/10
    dharmaglobeimposternanocorevidarxpertrat10/18credential_accessdefense_evasiondiscoveryevasionexecutionimpactkeyloggerpersistenceprivilege_escalationransomwareratspywarestealertrojan

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

      ransomwaredharma

    • Dharma family

      dharma

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Globeimposter family

      globeimposter

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • Nanocore family

      nanocore

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • XpertRAT Core payload

    • Xpertrat family

      xpertrat

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (292) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Vidar Stealer

      stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

8
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

3
T1490

Tasks