General
-
Target
RNSM00282.7z
-
Size
6.2MB
-
Sample
241119-1eh14asqdt
-
MD5
5af62ab1200f11c2a8f16099ce18409a
-
SHA1
9295dfda604e99c80a35b749b260b00b66d60df1
-
SHA256
97db43529fd69353e9ceefac584cc7a1aec8dbe9f7f444f70b7ac5067e27fe1f
-
SHA512
24209bca094aed1f29a7856dd440d4dc776dfb7920ed1b1b97b68da8b067f629d907d1cd3c59ade602ea52db5ca8c7a307ca2d01584553f92b92166f3bd186f2
-
SSDEEP
196608:QH9qbJam61w2+/ZIO6DL9yfgnjlLY0SQo2yP0HMB8ODTFVCZo1DC3:QHYbN6rNvDL/RLK/P4K8WFVCGI3
Static task
static1
Behavioral task
behavioral1
Sample
RNSM00282.7z
Resource
win7-20241010-en
Malware Config
Extracted
netwire
micro.loginto.me:3360
c0der.ddns.net:3360
bakbumz.ddns.net:3360
-
activex_autorun
true
-
activex_key
{IGXB136N-WP56-42I3-3EN8-85A00571YU01}
-
copy_executable
true
-
delete_original
false
-
host_id
2016-%Rand%
-
install_path
%AppData%\Install\Notepad.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
parola
-
registry_autorun
true
-
startup_name
Notepad
-
use_mutex
false
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+pofpi.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/70E2D9F0B522C0AF
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/70E2D9F0B522C0AF
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/70E2D9F0B522C0AF
http://xlowfznrg4wf7dli.ONION/70E2D9F0B522C0AF
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+lne.txt
http://alcov44uvcwkrend.softpay4562.com/13E9FBFA6C3A8CD7
http://tsbfdsv.extr6mchf.com/13E9FBFA6C3A8CD7
http://psbc532jm8c.hsh73cu37n1.net/13E9FBFA6C3A8CD7
https://vf4xdqg4mp3hnw5g.onion.to/13E9FBFA6C3A8CD7
http://vf4xdqg4mp3hnw5g.onion/13E9FBFA6C3A8CD7
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+man.txt
http://jf73ndna34df.ceorldess.com/13E9FBFA6C3A8CD7
http://fqa4dnfh5fsk4.tarsfee.com/13E9FBFA6C3A8CD7
http://hrdsjrnvskdjnt.pay4softrn.com/13E9FBFA6C3A8CD7
https://t7r67vsrpjcm5dfc.onion.to/13E9FBFA6C3A8CD7
https://t7r67vsrpjcm5dfc.tor2web.org/13E9FBFA6C3A8CD7
https://t7r67vsrpjcm5dfc.onion.cab/13E9FBFA6C3A8CD7
http://t7r67vsrpjcm5dfc.onion/13E9FBFA6C3A8CD7
Extracted
C:\Users\Admin\Desktop\_HELP_HELP_HELP_OVA31S_.hta
cerber
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+cljdp.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/59474F67A7E51D49
http://b4youfred5485jgsa3453f.italazudda.com/59474F67A7E51D49
http://5rport45vcdef345adfkksawe.bematvocal.at/59474F67A7E51D49
http://fwgrhsao3aoml7ej.onion/59474F67A7E51D49
http://fwgrhsao3aoml7ej.ONION/59474F67A7E51D49
Targets
-
-
Target
RNSM00282.7z
-
Size
6.2MB
-
MD5
5af62ab1200f11c2a8f16099ce18409a
-
SHA1
9295dfda604e99c80a35b749b260b00b66d60df1
-
SHA256
97db43529fd69353e9ceefac584cc7a1aec8dbe9f7f444f70b7ac5067e27fe1f
-
SHA512
24209bca094aed1f29a7856dd440d4dc776dfb7920ed1b1b97b68da8b067f629d907d1cd3c59ade602ea52db5ca8c7a307ca2d01584553f92b92166f3bd186f2
-
SSDEEP
196608:QH9qbJam61w2+/ZIO6DL9yfgnjlLY0SQo2yP0HMB8ODTFVCZo1DC3:QHYbN6rNvDL/RLK/P4K8WFVCGI3
-
Cerber family
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
Locky family
-
Locky_osiris family
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
NetWire RAT payload
-
Netwire family
-
Njrat family
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Troldesh family
-
Contacts a large (17503) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
ModiLoader Second Stage
-
Modifies boot configuration data using bcdedit
-
Renames multiple (179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Adds policy Run key to start application
-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Modifies Windows Firewall
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1