www.trendmicro.com
Open in
urlscan Pro
184.30.222.132
Public Scan
URL:
https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
Submission: On October 04 via api from DE — Scanned from DE
Submission: On October 04 via api from DE — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___TAzCT">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* Attack Surface Management
* Attack Surface Management
Operationalize a zero trust strategy
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Cloud Security Posture Management
* Cloud Security Posture Management
Leverage complete visibility and rapid remediation
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Storage Security
* File Storage Security
Security for cloud file/object storage services leveraging cloud-native
application architectures
Learn more
* Network Security
* Network Security
Advanced cloud-native network security detection, protection, and cyber
threat disruption for your single and multi-cloud environments.
Learn more
* Open Source Security
* Open Source Security
Visibility and monitoring of open source vulnerabilities for SecOps
Learn more
* Cloud Visibility
* Cloud Visibility
As your organization continues to move data and apps to the cloud and
transform your IT infrastructure, mitigating risk without slowing down
the business is critical.
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious applications,
and other mobile threats
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* All Products, Services and Trials
* All Products, Services and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* About Our Research
* About Our Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Blog
* Blog
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* The Trend Micro Difference
* The Trend Micro Difference
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Connect with Us
* Connect with Us
* Connect with Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
0
Back
Folio (0)
Support
* Business Support Portal
* Virus and Threat Help
* Renewals and Registration
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affililate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Ransomware
REFLECTIVE LOADING RUNS NETWALKER FILELESS RANSOMWARE
Ransomware in itself poses a formidable threat for organizations. As a fileless
threat, the risk is increased as it can more effectively evade detection. We
discuss how Netwalker ransomware is deployed filelessly through reflective DLL
injection.
By: Karen Victor May 18, 2020 Read time: 5 min (1290 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
Threat actors are continuously creating more sophisticated ways for malware to
evade defenses. We have observed Netwalker ransomware attacks that involve
malware that is not compiled, but written in PowerShell and executed directly in
memory and without storing the actual ransomware binary into the disk. This
makes this ransomware variant a fileless threat, enabling it to maintain
persistence and evade detection by abusing tools that are already in the system
to initiate attacks.
This type of threat leverages a technique called reflective dynamic-link library
(DLL) injection, also referred to as reflective DLL loading. The technique
allows the injection of a DLL from memory rather than from disk. This technique
is stealthier than regular DLL injection because aside from not needing the
actual DLL file on disk, it also does not need any windows loader for it to be
injected. This eliminates the need for registering the DLL as a loaded module of
a process, and allowing evasion from DLL load monitoring tools. Recently, we
have witnessed threat actors using this technique to deploy ColdLock ransomware.
Now, we have seen the same attack using a filelessly executed Netwalker
ransomware. The payload begins with a PowerShell script detected as
Ransom.PS1.NETWALKER.B.
ANALYSIS OF THE POWERSHELL SCRIPT
Figure 1. Overview of the PowerShell script’s behavior
The script hides under multiple layers of encryption, obfuscation, and encoding
techniques. For this sample, we were able to reveal three layers of code. The
top-most layer executes a base64-encoded command.
Figure 2. Code snippet of top-most layer of code (base64 encoded command)
Decoding this will expose the next layer of code, which is hexadecimal-encoded
and XOR-encrypted.
Figure 3. Second layer of code (hexadecimal-encoded and XOR-encrypted)
Decoding and decrypting will then reveal the main script, which is still quite
obfuscated, making the content more difficult for analysts to decipher.
Figure 4. Code snippet of the obfuscated main script
The file reflectively injects a ransomware DLL into the memory of the legitimate
running process explorer.exe. The ransomware is embedded in the script in hex
format.
Figure 5. Ransomware binaries embedded in the script in hex format
Taking the binaries out of the script and decoding them will result in two DLLs;
one is an x86 version (for 32 bit OS) of the ransomware, while the other is the
x64 version (for 64 bit OS).
It uses the following part of the script to determine the environment it is
running on so that it can set the DLL version to use:
Figure 6. Script that determines what environment the ransomware is running on
To successfully perform reflective injection, it first locates the API addresses
of the functions it needs from kernell32.dll:
Figure 7. Ransomware collecting API Addresses from kernell32.dll
Then it uses the following functions to set up accurate memory address
calculations:
Figure 8. Functions for setting up memory calculations
Figure 9. Code snippet for computing the needed memory addresses
In this manner, the script itself acts as the DLL’s own custom loader. This
eliminates the need for a traditional windows loader, which usually makes use of
the LoadLibrary function. The script itself can compute and resolve its needed
memory address and relocations to load the DLL correctly.
It then specifies the process it will inject into; in this case it searches for
the running Windows Explorer process.
Figure 10. Code snippet for searching running Windows Explorer process
Afterwards, it will write and execute the ransomware DLL into the memory space
of explorer.exe through the following code:
Figure 11. Code snippet of writing the ransomware DLL code into memory
Finally, it deletes Shadow Volume Copies and prevent the victim from using
Shadow Volumes to recover their encrypted files.
Figure 12. Code snippet for deleting Shadow Volume Copies
This sample appears to have been derived from PowerSploit’s Invoke-Mimikatz
module, an open source program that was originally intended to reflectively load
Mimikatz completely in memory for stealthy credential dumping.
ANALYSIS OF THE FILELESS RANSOMWARE
This variant of Netwalker is similar to its predecessors in terms of behavior.
It renames encrypted files using 6 random characters as extension:
Figure 13. Encrypted files renamed using 6 random characters as extension
It drops ransom notes at various folders in the system and opens one after it
has encrypted the data and documents of the victim. As with usual ransomware, it
does this to extort money from the victim in exchange for the decryption of
their files.
Figure 14. Netwalker ransom note
It adds the following registry entry. Adding this entry is a known behavior of
Netwalker:
HKEY_CURRENT_USER\SOFTWARE\{8 random characters}
{8 random characters} = {Hex values}
Figure 15. Sample registry entry added by Netwalker
The ransomware terminates some processes and services, some examples of which
are related to backup software and data related applications. It is likely that
it does this as an attempt to debilitate any efforts the victim may take in
performing backup and recovery operations after the ransomware attack.
Below are some examples of services terminated by the ransomware (for the full
list of services, please see this report):
* *backup*
* *sql*
* AcronisAgent
* ARSM
* server Administrator
* ShadowProtectSvc
* wbengine
The ransomware also stops security software-related processes to evade detection
and termination of its malicious activities.
Additionally, it also terminates processes relating to user data and documents,
as well as software for creating backups. Then it will proceed to encrypt files
created through those applications.
Example processes terminated by the ransomware (for the full list of processes,
please see this report):
* *sql*
* excel.exe
* ntrtscan.exe
* powerpnt.exe
* wbengine*
* winword.exe
* wrsa.exe
Netwalker mainly targets common user files during its encryption routine, such
as Office documents, PDFs, images, videos, audio, and text files, among others.
Other than that, it apparently doesn’t want to render the system completely
useless since it generally avoids encrypting any critical files, executables,
Dynamic Link Libraries, registries, or other system-related files.
CONCLUSIONS AND RECOMMENDATIONS
It appears that attackers are now adding Reflective DLL injection into their
ransomware arsenal in an attempt to make their attacks untraceable and more
difficult to investigate by security analysts. Ransomware in itself poses a
formidable threat for organizations. As a fileless threat, the risk is increased
as it can more effectively evade detection and maintain persistence. Blended
threats such as this make use of multiple techniques, making it necessary for
organizations to use various layers of security technologies to effectively
protect their endpoints, such as security solutions that employ behavior
monitoring and behavior-based detections.
These types of attacks can affect victims tremendously, and they can be
painstakingly difficult to recover from. Employing adequate preventive measures,
such as applying best practices, will greatly minimize the risk of infection.
Here are some of our recommendations to help avoid ransomware attacks:
* Regularly back up critical data to mitigate the effects of a ransomware
attack
* Apply the latest software patches from OS and third-party vendors.
* Exercise good email and website safety practices
* For employees, alert the IT security team of potentially suspicious emails
and files.
* Implement application whitelisting on your endpoints to block all unknown and
unwanted applications.
* Regularly educate employees on the dangers of social engineering.
Below are some of our recommendations to protect systems from fileless threats:
* Secure PowerShell use by taking advantage of its logging capability to
monitor suspicious behavior.
* Use PowerShell commands such as ConstrainedLanguageMode to secure systems
from malicious code.
* Configure system components and disable unused and outdated ones to block
possible entry points.
* Never download and execute files from unfamiliar sources
We also recommend security solutions that utilize behavior monitoring that can
work against these types of threats:
* Trend Micro Apex One™ - Features behavioral analysis that protects against
malicious scripts, injection, ransomware, and memory and browser attacks
related to fileless threats.
INDICATOR OF COMPROMISE
SHA-256 Trend Micro Pattern Detection
f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be
Ransom.PS1.NETWALKER.B
Tags
Malware | Endpoints | Research | Ransomware
AUTHORS
* Karen Victor
Threats Analyst
Contact Us
Subscribe
RELATED ARTICLES
* Revisiting 16shop Phishing Kit, Trend-Interpol Partnership
* APT34 Deploys Phishing Attack With New Malware
* Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral
Movement
See all articles
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2023 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
Sumo