Netwalker

In April 2020, actors using Netwalker began gaining unauthorized access to victim networks by exploiting... weak passwords used for Remote Desktop Protocol connections.

In April 2020, actors using Netwalker began gaining unauthorized access to victim networks by exploiting unpatched Virtual Private Network (VPN) appliances...

According to Stern, Netwalker will use the TrickBot botnet to distribute their malware.

In April 2020, actors using Netwalker began gaining unauthorized access to victim networks by exploiting unpatched Virtual Private Network (VPN) appliances, vulnerable user interface components in web applications... Two of the most common vulnerabilities exploited by actors using Netwalker are Pulse Secure VPN (CVE-2019-11510) and Telerik UI (CVE-2019-18935).

Initial delivery is primarily via email with malicious attachments... More recently, we have observed NetWalker spam campaigns using COVID-19-related lures to entice victims into initiating infection.

In March 2020, multiple hospitals in Spain were targeted. In those specific attacks, victims were enticed with ‘updated information on COVID-19’ via attached PDF files. These PDFs were weaponized and led to the installation of the ransomware.

[Netwalker](https://attack.mitre.org/software/S0457) can use WMI to delete Shadow Volumes.(Citation: TrendMicro Netwalker May 2020)

MITRE ATT&CK T1053 – Scheduled Task

Through multiple stages of obfuscated JavaScript, VBS scripts and/or PowerShell, the final Ursnif payload is written to the victim host.

[Netwalker](https://attack.mitre.org/software/S0457) has been written in PowerShell and executed directly in memory, avoiding detection.(Citation: TrendMicro Netwalker May 2020)(Citation: Sophos Netwalker May 2020)

Operators deploying [Netwalker](https://attack.mitre.org/software/S0457) have used batch scripts to retrieve the [Netwalker](https://attack.mitre.org/software/S0457) payload.(Citation: Sophos Netwalker May 2020)

The malicious document then proceeds to drop and execute a VBS script. This script establishes C2 communication channels, and downloads additional executable payloads.

[Netwalker](https://attack.mitre.org/software/S0457) can use Windows API functions to inject the ransomware DLL.(Citation: TrendMicro Netwalker May 2020)

Citrix ADC maintains a vulnerable Perl script (newbm.pl) that, when accessed via HTTP POST request ... allows local operating system (OS) commands to execute. Attackers can use this functionality to upload/execute command and control (C2) software ... and gain unauthorized access to the OS.

When the script is executed, the executable will be saved to %Temp%\qeSw.exe and launched.

La muestra de ransomware NetWalker analizada ha sido distribuida utilizando un dropper desarrollado en Visual Basic Script (VBS), que se incluye como fichero adjunto en la campaña de spam.

Operators deploying [Netwalker](https://attack.mitre.org/software/S0457) have used psexec and certutil to retrieve the [Netwalker](https://attack.mitre.org/software/S0457) payload.(Citation: Sophos Netwalker May 2020)

MITRE ATT&CK T1053 – Scheduled Task

In April 2020, actors using Netwalker began gaining unauthorized access to victim networks by exploiting... weak passwords used for Remote Desktop Protocol connections.

[Netwalker](https://attack.mitre.org/software/S0457) can add the following registry entry: <code>HKEY_CURRENT_USER\SOFTWARE\{8 random characters}</code>.(Citation: TrendMicro Netwalker May 2020)

In April 2020, actors using Netwalker began gaining unauthorized access to victim networks by exploiting unpatched Virtual Private Network (VPN) appliances...

...файл сбрасывается в "ProgramFiles", а также в запись RUN, уничтожая следы его существования.

MITRE ATT&CK T1053 – Scheduled Task

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

The [Netwalker](https://attack.mitre.org/software/S0457) DLL has been injected reflectively into the memory of a legitimate running process.(Citation: TrendMicro Netwalker May 2020)

This includes process hollowing, in which the malware injects itself into a legitimate process such as explorer.exe and removes the original executable.

the attacker also leveraged several vulnerabilities for privilege escalation. One of them is CVE-2020-0796

In April 2020, actors using Netwalker began gaining unauthorized access to victim networks by exploiting... weak passwords used for Remote Desktop Protocol connections.

Acquisizione dei privilegi di Debug e impersonificazione di altri processi... Prima impersona winlogon.exe e dopo recupera il token di explorer.

...файл сбрасывается в "ProgramFiles", а также в запись RUN, уничтожая следы его существования.

I notice that there are no MZ header to the binary file that are one technique to evade memory forensic tools or some quick check for injected executable to a process. | This also include the first part which is a obfuscated powershell that will serve as the loader of the malware.

One of the more creative ways to disguise threat activity comes in the form of packing software – a technique that applies a packing algorithm on malware to produce a file that is harder to detect, analyze, and prevent.

It will dynamically harvest its needed API using some hashing algorithm search to all export table of all needed DLL modules to executes its malicious code then save it to a structure object.

[Netwalker](https://attack.mitre.org/software/S0457)'s DLL has been embedded within the PowerShell script in hex format.(Citation: TrendMicro Netwalker May 2020)

[Netwalker](https://attack.mitre.org/software/S0457)'s PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.(Citation: TrendMicro Netwalker May 2020)(Citation: Sophos Netwalker May 2020)

In a recent sample of the Mailto ransomware shared with BleepingComputer by MalwareHunterTeam, the executable attempts to impersonate the 'Sticky Password' software.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

The [Netwalker](https://attack.mitre.org/software/S0457) DLL has been injected reflectively into the memory of a legitimate running process.(Citation: TrendMicro Netwalker May 2020)

This includes process hollowing, in which the malware injects itself into a legitimate process such as explorer.exe and removes the original executable.

Además, el ejecutable responsable del cifrado se autoelimina tras finalizar su ejecución.

unica parte degna di nota sono le ultime due righe che cancellano le copie per il ripristino dei dati

In April 2020, actors using Netwalker began gaining unauthorized access to victim networks by exploiting... weak passwords used for Remote Desktop Protocol connections.

Acquisizione dei privilegi di Debug e impersonificazione di altri processi... Prima impersona winlogon.exe e dopo recupera il token di explorer.

[Netwalker](https://attack.mitre.org/software/S0457)'s PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the [Netwalker](https://attack.mitre.org/software/S0457) DLL being loaded into memory.(Citation: Sophos Netwalker May 2020)

...с помощью API Restart Manager... разблокировку процессов

“APT41 used certutil to download additional files.”; “Astaroth uses certutil and BITSAdmin to download additional malware.”; “CARROTBAT… download and execute a remote file via certutil.”; “Netwalker… used psexec and certutil to retrieve the Netwalker payload.”

The content includes environment-aware checks such as "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "CaddyWiper can also halt execution if the compromised host is identified as a domain controller," and "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks."

Cobalt Strike has the ability to load DLLs via reflective injection... Lazarus Group malware sample performs reflective DLL injection... Matryoshka uses reflective DLL injection... Netwalker DLL has been injected reflectively into the memory of a legitimate running process.

[Netwalker](https://attack.mitre.org/software/S0457) can add the following registry entry: <code>HKEY_CURRENT_USER\SOFTWARE\{8 random characters}</code>.(Citation: TrendMicro Netwalker May 2020)

Gli attributi originali del file sono salvati e poi cambiati in FILE_ATTRIBUTE_ARCHIVE

[Netwalker](https://attack.mitre.org/software/S0457) can detect and terminate active security software-related processes on infected systems.(Citation: TrendMicro Netwalker May 2020)(Citation: Sophos Netwalker May 2020)

These tools can include mimikatz (and variations thereof), various PSTools, AnyDesk, TeamViewer, NLBrute and more.

AdFind can be used to discover computers, users, or groups with AD as a reconnaissance tool...

usando NtQuerySystemInformation ... per enumerare tutti i processi

[Netwalker](https://attack.mitre.org/software/S0457) can determine the system architecture it is running on to choose which version of the DLL to use.(Citation: TrendMicro Netwalker May 2020)

usa FindFirstFileEx per enumerare tutte le cartelle ed i file in questo percorso

GetNetShares is often called to assist in locating hidden or administrative shares (admin$ / IPC$).

AdFind can query AD for computers, identify domain users and domain groups, extract subnet information from AD, and collect information about organizational units on domain trusts.

The content includes environment-aware checks such as "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "CaddyWiper can also halt execution if the compromised host is identified as a domain controller," and "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks."

[Netwalker](https://attack.mitre.org/software/S0457) can detect and terminate active security software-related processes on infected systems.(Citation: TrendMicro Netwalker May 2020)

By working their way into privileged access on the target environment’s domain controller, they aim to launch the specialized loader on as many hosts as accessible.

In April 2020, actors using Netwalker began gaining unauthorized access to victim networks by exploiting... weak passwords used for Remote Desktop Protocol connections.

PsExec can also be used for propagation and remote execution of ransomware.

Bentley was in charge of onboarding Netwalker to their admin panel, VNC, etc.

Operators deploying [Netwalker](https://attack.mitre.org/software/S0457) have used psexec to copy the [Netwalker](https://attack.mitre.org/software/S0457) payload across accessible systems.(Citation: Sophos Netwalker May 2020)

According to Netwalker, they stole about 5 terabytes of data from Enel and are ready to make public a piece of it in a week.

Using Tor, a computer network designed to facilitate anonymous communication over the internet, the victim is then provided with the amount of ransom demanded and instructions for payment.

Operators deploying [Netwalker](https://attack.mitre.org/software/S0457) have used psexec and certutil to retrieve the [Netwalker](https://attack.mitre.org/software/S0457) payload.(Citation: Sophos Netwalker May 2020)

Netwalker ransomware relies on multiple programs for remote access (Team Viewer, AnyDesk)

This means publishing proof that they have the goods, an attempt to pressure the company into paying the ransom... According to Netwalker, they stole about 5 terabytes of data from Enel

The attacks Desjardins participated in resulted in losses of millions of dollars after the victims had data stolen from their networks and were extorted into paying millions worth of cryptocurrency as ransoms.

Actors using Netwalker have previously uploaded stolen data to the cloud storage and file sharing service, MEGA.NZ (MEGA), by uploading the data through the MEGA website or by installing the MEGA client application directly on a victim’s computer. In June 2020, actors transitioned from uploading and releasing stolen data on MEGA to uploading the stolen data to another file sharing service: website.dropmefiles.com.

As 14 ransomware gangs are now stealing data and publishing it in their blogs, we can assume that more ransomware operators will adopt the tactic and will require double ransoms.

[Netwalker](https://attack.mitre.org/software/S0457) can encrypt files on infected machines to extort victims.(Citation: TrendMicro Netwalker May 2020)

[Netwalker](https://attack.mitre.org/software/S0457) can terminate system processes and services, some of which relate to backup software.(Citation: TrendMicro Netwalker May 2020)

[Netwalker](https://attack.mitre.org/software/S0457) can delete the infected system's Shadow Volumes to prevent recovery.(Citation: TrendMicro Netwalker May 2020)(Citation: Sophos Netwalker May 2020)

NetWalker harvests data from its targets and is used by the operators as leverage via threats to post or release the data in the event that the target does not comply with their demands.