Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 20:22

General

  • Target

    2025-01-22_12448b9b16e1c3a907f669ff5906046d_babuk_mailto.exe

  • Size

    82KB

  • MD5

    12448b9b16e1c3a907f669ff5906046d

  • SHA1

    264a5f682001eae793103023f35b0a865b48d25b

  • SHA256

    d68ec0df2b057387bbd78a51054f7c06bdf029337bf9d66c1d411ba0243b2ae5

  • SHA512

    58870722418a14fbc86062979b8b93fc9aa31848b03217fc7534b6bd9d03383de5ad338cd75376f8bbee378f38d5e473364429cf8bc631a5125e5e65314b7be3

  • SSDEEP

    1536:yoF+QbXFzvL4ZwxY/ic0ty2XGf0s7pBZWNFMSZs1:yiFF7Loxt0tyAGf0sN5S2

Malware Config

Extracted

Path

C:\Users\Admin\Searches\4D33-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .4d33 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised, rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you, it could be files on the network belonging to other users, sure you want to take that responsibility? -- Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help. The only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover. We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned. For us this is just business and to prove to you our seriousness, we will decrypt you some files for free, but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision. Contact us: [email protected] [email protected] Don't forget to include your code in the email: {code_4d33:/ymFE3Ty86+vYFtWnfNUA5hZLcgjR2pBn5TnP8uh3l49HBFuM0 3xCkjzY+HOCwtuRqDH5Spd9xrGRPYRjq5mK9RcCBNfU9MXjuev +gjjxGamlbrfBDqP1HLYqu0DVd8dDLFBNPLVdUmZWF2Vc3a+Fi suh98OvHlCudkEiqah0DyIXAsFFMJ6vuDl6wn73k+1uZBCiFZG 5bclb1qYgLCWCy/uPJiaTMNdy0Qci+aXEs4QOTRCwZ/bMof/nE KHuDgJQ0SycE/2kGCRQGzL2We5A575HQ==}

Signatures

  • Detected Netwalker Ransomware 64 IoCs

    Detected unpacked Netwalker executable.

  • Netwalker Ransomware

    Ransomware family with multiple versions. Also known as MailTo.

  • Netwalker family
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Renames multiple (167) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-22_12448b9b16e1c3a907f669ff5906046d_babuk_mailto.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-22_12448b9b16e1c3a907f669ff5906046d_babuk_mailto.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\system32\explorer.exe"
      2⤵
      • Deletes itself
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\system32\explorer.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Windows\system32\vssadmin.exe
          C:\Windows\system32\vssadmin.exe delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:6184
      • C:\Windows\SysWOW64\notepad.exe
        C:\Windows\system32\notepad.exe C:\Users\Admin\Desktop\4D33-Readme.txt
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6828
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\system32\vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3440
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:7944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Searches\4D33-Readme.txt

    Filesize

    1KB

    MD5

    f6e8554a074dcdae752aa146f9a36d3d

    SHA1

    e365c1c645e61c4dea4569d0a6e4ea26fcc75afa

    SHA256

    c57b2712ed2968c217c4730bd0876f2ffb45197edf46e5f9b48425d32bd59f72

    SHA512

    db51ef0c7d4c8b71db7483ee534773ec433097957959ecc4c33a8f9e7c056170ab98fcc601cd21431b1aa5dcb3bd9f33561c1c2c416e6754b9f6456bc5afcbe7

  • memory/1472-483-0x0000000000E00000-0x0000000000E19000-memory.dmp

    Filesize

    100KB

  • memory/2864-0-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-2-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-3-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-6-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-28-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-39-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-65-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-64-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-63-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-62-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-61-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-60-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-59-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-58-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-57-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-56-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-55-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-54-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-53-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-52-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-51-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-50-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-49-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-48-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-47-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-46-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-45-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-44-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-43-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-42-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-41-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-38-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-35-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-34-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-33-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-32-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-31-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-30-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-27-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-26-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-25-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-24-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-23-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-22-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-21-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-20-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-17-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-16-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-15-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-14-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-13-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-12-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-11-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-10-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-9-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-5-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-19-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-4-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-18-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-8-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-7-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-1778-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB

  • memory/2864-1787-0x00000000012B0000-0x00000000012C9000-memory.dmp

    Filesize

    100KB