Overview

overview

10

Static

static

1

RNSM00343.7z

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RNSM00343.7z

  • Size

    1.3MB

  • Sample

    241110-vkp4pstrcn

  • MD5

    4fe3af6bac579438ff43b2496a83f194

  • SHA1

    5934f6206616690c5857e229d34a1da14c70f7b0

  • SHA256

    173ca0f92742d045715ebb426f110998ab55fe3e8c2694b34dda2024322ad03f

  • SHA512

    9abd4145f4e76a0149d2bc510409146efe22b867f1438672aa97144efee57b33a4ecf64c2b43c57d82728598d2db1f177a2037343c590e20a8e2de0372303fba

  • SSDEEP

    24576:klryBLsPFe31HEXPzUmWzx8fnwzdLQ2jVj0OYha0iLjpDk6uwj4Acfu5vkkvJlyt:VBLwaEXbUHEwVdxjVuy47AvVRcwBk/

Score
10/10
gandcrabnetwirebackdoorbotnetcredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\HELP_RESTORE_FILES.txt

Ransom Note
All your documents, photos, databases and other important files have been encrypted with strongest encryption RSA-2048 key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main encryptor red window, examine it and follow the instructions. Otherwise, it seems that you or your antivirus deleted the encryptor program. Now you have the last chance to decrypt your files. Open http://3kxwjihmkgibht2s.wh47f2as19.com or http://34r6hq26q2h4jkzj.7hwr34n18.com , https://3kxwjihmkgibht2s.s5.tor-gateways.de/ in your browser. They are public gates to the secret server. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 1N9dsduqYSk1zVrHVCN5rFFyk15mRyJKgq Follow the instructions on the server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://34r6hq26q2h4jkzj.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 1N9dsduqYSk1zVrHVCN5rFFyk15mRyJKgq Follow the instructions on the server.
Wallets

1N9dsduqYSk1zVrHVCN5rFFyk15mRyJKgq

URLs

http://3kxwjihmkgibht2s.wh47f2as19.com

http://34r6hq26q2h4jkzj.7hwr34n18.com

https://3kxwjihmkgibht2s.s5.tor-gateways.de/

http://34r6hq26q2h4jkzj.onion/

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\DYEYFMNF-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .DYEYFMNF The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/2cd5b16f4409ceb8 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAMAjflw9OaPT4UtFhjlEaVbwakdgw20xEAJFolqxJp/6tuWX6lZ4mFEv4VIRjrkNWV75YOcK/ldE9vS4CY8cNxOYkQD/rpQrY0CfRiBYxMwslWSDPMh0dCHmbzY3iM6+Jg4nna4Z2E4XZ1JTh4RiH3MN9SF/gNbNX2bxqC7cgK0uzLb1ownnrpgd3BQ7a19lzTbEno8rFDeKMzm2RCjnI8mp/MaPp2rsYG2m6+yK3rJ+54YYbjnUtqqehFRWs79sUaP3iTlez4pgalzmCHpWJrTdD9l3ZWBfwrH1461Vms/OKc9n9XwAI4uALAYIzxdl9SjJF4W5JrC9J/EX9ar2+kIYvk/JdWdU+l2MK3/c3penaAELVIBw+qBPSUILHsZ2vvAt0+22sxGrdsldkUfDj2NU7R2jt8Rl7WgLigZyIuPD7zM8nf1UTRbLPu1j34xEh3CadgodLSeuwVHnuWJySs6kxWZb6WcZOopyrLUO91kX14mEnTrwrg4RPu/3T3o9Ozu8nCSyZv0vxl8Q5OOZ8TamiHrLPY36EtG4kY9WWxqSz/OInCq2DrNQDNMMHQFx+WDp2zWl5ZUyg3QMjiYsa8YSoCauveSChK4xG5uWZ4g7smX6BuQoFJoqEWSRMdcYrqSXdgJxrKPqG9r2o/Rw4dduRz3Wk3WqrC2C7WOrHk4YUIirTu6i7W4ZWX96xOjY7/dusWeMrSz3TT/rpPj8TppwoXNfiTy1di7HFaVIFT/G1xU0Rv5ONTosGft1wtcKvN7PwefwMtixtK/O3hJMke/FreJEic/+LjeEcg9ORRznfiWrZBgBAH6QPqJyUHLIN/AebJuLlLgH/XnQjaPWS3XHRGSWlctUVfjqZGM0daj6xbcgbCe7YFUvsQLtyLA9EraNHiYjNJm/fhzwvKignRPB4Wz1N43zNPFvPBgEGKrOrdyQ/RmvZAQXk28lsrDTf7QpaU6j/IrwJFBkXdPXMz1EQ9DmTztbMXTomiUMwxjPh+REPRPC5neeznxptX8qy+zCpRqsLgJXgjb9AdoQzFk5rxzyOMIeX27AWSt5SSOh1N1Icys9evomk9ITdPZFCCu+B982c2d/QwfIYrK17gx2q8vKyo2UyiFWWEBDAvU2LHSbAHXSpAKw9QSogT1UqWnxXh5sX5mAlzcNbWI+xkmG8l2KqqMtU4jzyFsK1GzXS5owx7wZy2C0mSgP6e4luiD1p3pqUL4BUWItEDR99W6Tt7Xw1BwR67VV5O+VAhfIvbz2UlAw+hfFjICBRoEWSHUyerrsSl/19n/ukO5Pf7X2JQSKJkTClOyKYkEgwIP+6Fm5ATClyEWKQ0IstpSU1vOU/KPTYCbTUeFjwe6YWnDD0kw4HoBp9qC06ddJd22pvegZ+eikiLgE4NaXh5BkXQKPEi1KZ81lvSg0ymVsCsQgIhRHnrigrhNoHoNafy/YQdtByj/paxXEXKqz5THIDEDm351T4N7omi8Bqd4qYVI1WvZDIZdcz+rxhA4oBxe1+FkIbDnyTSD4f6FLAZFpvr7zVFKDQcc0dQHtD+WrnhTSiywOcZil6mm/9tlR8TijgYFOoenPRLaZhBxr2mCf4o4xUW4+bQqdEtVoAWzzkzZe9lsANWPny9stH0dTWC3Lm/dRYEY/8Lyv1y148uCh8N1uLQMq48eN6YdTcfD8j1uQfVIgPtLA6DfM0Aw15Ri4bKq8yvlUTXB8nw/X+aVL/1Mc2n2Hq2BpG1nAt/VvZwlJ3cp3yt8/068zGG6lweMCdKFyDyAYAnQ0uqXoM+6Y+8x4tUEHOX+SR8d998KM10AVXmJgQEazqMcIv/OisLJoWcSW1RctDAKbvYS2RBfvnnxbxYpbQ/6sJ/s+TePyOG3wOEB8nRQd042vlZaIbQ/CmRBSF7aq8Q1Kycfc6ApkVX/Kk8xVTD8KiFTSSwueNotoQk9qJamz/G9Rl66njIn1i5xIVOzpE54SxMugsV76Y4z01BpKG3UJ8lVldxd2Fdw4g+LwF8oNSkr9vAX1WGJpt0D45GZ8134qfMjAwEITEsCx2YKBCRv1hhSyecE9L61R8/kWPDCraub7W3CTl57oA4h3eQNhjLalYyufeRHdyKvtLLKDmWU8mHsBo4u/O3r21FpnU65YsSvgTgNI1UmEFlcirV3MibPRmIK/2NXZh4aNskeJL4BS/9yLdK0zCVepg8CgdDyTiBdsV87oZoMfXRhOZrQwIOiTw68IIit3jELDTz4= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZaTo9Rr3YZ7nZWvbfZTHWHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi4bEhkRzB5eL2/2c2F+twGt9YaFqDBi7t/hGDEYsbqScE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJppFrwNIoDBPOnKw+A+5ZALufjGEwg7NrKg3qxA9Kwg73ZibpDxFI3vfLM+ar1wIZLXRgRl+KCjmo1jngAX95mSffmizzQU1nmrIqlsew6HIMVY3pdDfwfAscdcBnP3FNhn9WQ3XC06ZCEvXtdUj8BYRMbJH8HpwOar+NRZwP9okRV/rusrPFzMH9O3YCh9gzrewdRb9tHf+DbmDW4OIcXpVeLdQr9FxhPlLL2u9gwWmeLQ4zxgtafmr5TWEPiWMEkrI= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/2cd5b16f4409ceb8

Extracted

Family

netwire

C2

fingers1.ddns.net:3360

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    New Money

  • keylogger_dir

    C:\Users\Admin\AppData\Roaming\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      RNSM00343.7z

    • Size

      1.3MB

    • MD5

      4fe3af6bac579438ff43b2496a83f194

    • SHA1

      5934f6206616690c5857e229d34a1da14c70f7b0

    • SHA256

      173ca0f92742d045715ebb426f110998ab55fe3e8c2694b34dda2024322ad03f

    • SHA512

      9abd4145f4e76a0149d2bc510409146efe22b867f1438672aa97144efee57b33a4ecf64c2b43c57d82728598d2db1f177a2037343c590e20a8e2de0372303fba

    • SSDEEP

      24576:klryBLsPFe31HEXPzUmWzx8fnwzdLQ2jVj0OYha0iLjpDk6uwj4Acfu5vkkvJlyt:VBLwaEXbUHEwVdxjVuy47AvVRcwBk/

    Score
    10/10
    gandcrabnetwirebackdoorbotnetcredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealer

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (299) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

2
T1490

Tasks