General
-
Target
RNSM00337.7z
-
Size
4.1MB
-
Sample
241111-zem5dawcjj
-
MD5
4cb91b29c77e16b381c510e008f8b9b5
-
SHA1
34ec03f93f1c8de64fe59988f47762d6f4b9beda
-
SHA256
e7c71bd7485c55cee4e7db25051be38827cc70892f37b4eb452e7990be0deacf
-
SHA512
6333c6f2ce7066ab207e625f5a2aae6777efd7bca9f49d67c3c129fdb1aa6b74d2ae361bf2c161da667c79d7366d288edd1e0c89856290e3d03a9925bc1fac80
-
SSDEEP
98304:EcOAE5Imy2vZfqAd9JiamPMmwQuRMIiNY+Vf09eCOL:EcOAew29/QamPM5xjiS+J09ehL
Static task
static1
Behavioral task
behavioral1
Sample
RNSM00337.7z
Resource
win7-20241010-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.free3v.net - Port:
21 - Username:
money8 - Password:
12345678
Extracted
C:\Users\Admin\Music\#Decrypt_Files_ReadMe#.rtf
https://bitmsg.me}}}\f0\fs24
https://bitmsg.me/users/sign_up}}}\f0\fs24
https://bitmsg.me/users/sign_in}}}\f0\fs24
Extracted
C:\$Recycle.Bin\LSPQMCX-DECRYPT.txt
http://gandcrabmfe6mnef.onion/b7ac704af1825434
Extracted
gozi
Extracted
njrat
0.6.4
HacKed
shadowpro87.ddns.net:1177
9165950e91e4e361fa21d31cf1cfc39b
-
reg_key
9165950e91e4e361fa21d31cf1cfc39b
-
splitter
|'|'|
Targets
-
-
Target
RNSM00337.7z
-
Size
4.1MB
-
MD5
4cb91b29c77e16b381c510e008f8b9b5
-
SHA1
34ec03f93f1c8de64fe59988f47762d6f4b9beda
-
SHA256
e7c71bd7485c55cee4e7db25051be38827cc70892f37b4eb452e7990be0deacf
-
SHA512
6333c6f2ce7066ab207e625f5a2aae6777efd7bca9f49d67c3c129fdb1aa6b74d2ae361bf2c161da667c79d7366d288edd1e0c89856290e3d03a9925bc1fac80
-
SSDEEP
98304:EcOAE5Imy2vZfqAd9JiamPMmwQuRMIiNY+Vf09eCOL:EcOAew29/QamPM5xjiS+J09ehL
-
Gandcrab family
-
Gozi family
-
Matrix Ransomware
Targeted ransomware with information collection and encryption functionality.
-
Matrix family
-
Njrat family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (330) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
3Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1