File name:

netwalker.vbs

Full analysis: https://app.any.run/tasks/a8c787da-5593-4934-87c3-1c569c9e190f
Verdict: Malicious activity
Threats:

Netwalker is ransomware — it belongs to a malware family which encrypts files and demands users to pay a ransom to get their data back. Netwalker utilizes several sophisticated techniques, such as process hollowing and code obfuscation to target corporate victims.

Malware Trends Tracker     >>>
Analysis date: May 13, 2020, 20:03:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
netwalker
stealer
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

5B80CBBDCB697C0B8EC26E6CF0FF305C

SHA1:

F26323676B7ED39590DDFEDD344B0CF605393598

SHA256:

AD8D379A4431CABD079A1C34ADD903451E11F06652FE28D3F3EDB6C469C43893

SSDEEP:

3072:AEe+n+jGECbFXc7tt8PWmMFqHGnxnMx/nbUArHxWNyEAWPRhNa:AEfT27MPWumxM+7N/AwM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Gpbo.exe (PID: 3844)

    • Netwalker ransom note found

      • Gpbo.exe (PID: 3844)

    • Deletes shadow copies

      • Gpbo.exe (PID: 3844)

    • Stealing of credential data

      • Gpbo.exe (PID: 3844)

    • Loads the Task Scheduler COM API

      • Gpbo.exe (PID: 3844)

    • Renames files like Ransomware

      • Gpbo.exe (PID: 3844)

    • Modifies files in Chrome extension folder

      • Gpbo.exe (PID: 3844)

    • NetWalker was detected

      • Gpbo.exe (PID: 3844)

    • Actions looks like stealing of personal data

      • Gpbo.exe (PID: 3844)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2124)
      • Gpbo.exe (PID: 3844)

    • Reads the cookies of Google Chrome

      • Gpbo.exe (PID: 3844)

    • Creates files like Ransomware instruction

      • Gpbo.exe (PID: 3844)

    • Creates files in the user directory

      • Gpbo.exe (PID: 3844)

    • Creates files in the program directory

      • Gpbo.exe (PID: 3844)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • Gpbo.exe (PID: 3844)

    • Dropped object may contain TOR URL's

      • Gpbo.exe (PID: 3844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start wscript.exe #NETWALKER gpbo.exe vssadmin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\netwalker.vbs"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3464C:\Windows\system32\vssadmin.exe delete shadows /all /quietC:\Windows\system32\vssadmin.exe—Gpbo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3844C:\Users\admin\AppData\Local\Temp\Gpbo.exeC:\Users\admin\AppData\Local\Temp\Gpbo.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WTV file converter
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\gpbo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
35
Read events
33
Write events
2
Delete events
0

Modification events

(PID) Process:(3844) Gpbo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\0b1567bf
Operation:writeName:0b1567bf
Value:
8E40CB9B55B19A834D8F8AEB5C865BC3C42B2ECD10C7FF587C78159018398D789F90CC8215DCF08DFE3D0A67A8A93DCC5AA5086DEADA08A2EDC2AB2E67C58909BDE1D71D8A2895928A916C2876F196F2D6ED9D95B80999F7B74F9E328D8A9BF815125469DBB61C2E9F8618F0024D043CA1E121FAA17490722FFBF8C672B23402DD9779D6785CE8B514980C4A
(PID) Process:(3844) Gpbo.exeKey:HKEY_CURRENT_USER\Software\0b1567bf
Operation:writeName:0b1567bf
Value:
8E40CB9B55B19A834D8F8AEB5C865BC3C42B2ECD10C7FF587C78159018398D789F90CC8215DCF08DFE3D0A67A8A93DCC5AA5086DEADA08A2EDC2AB2E67C58909BDE1D71D8A2895928A916C2876F196F2D6ED9D95B80999F7B74F9E328D8A9BF815125469DBB61C2E9F8618F0024D043CA1E121FAA17490722FFBF8C672B23402DD9779D6785CE8B514980C4A
Executable files
20
Suspicious files
1 859
Text files
614
Unknown types
420

Dropped files

PID
Process
Filename
Type
3844Gpbo.exeC:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxHbinary
MD5:B7F09FBAD56D5F5EFC1F9C27A1155307
SHA256:ADEA49518D9D6E0B97B15E82D836DC2EE6B70DE4124F52F209C242C380D33658
3844Gpbo.exeC:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxWbinary
MD5:DA257BFD4C9B33CED01E38A881935438
SHA256:AD1DD23A507DF06B01895F212D822C1AFFF8C5519CE7D9E252AA2138649FC16F
3844Gpbo.exeC:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxnbinary
MD5:A0F37FD486B76044569BF172F641EC81
SHA256:8EDD97F24946D7493EBE0B57888446EBFC788D00F3A2F6DB82A35D19C570176A
3844Gpbo.exeC:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx.hxnbinary
MD5:A98430EA91A35421BDC1FDB8A8AD97F1
SHA256:2CE9EF90C13678C9EBEF593207BF1D9CE1F8BB6A9CB41726143D154C1501886C
3844Gpbo.exeC:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.EXCEL.14.1031.hxnbinary
MD5:9AEC403E2D810C46A433851DAFD4F097
SHA256:938DF888103D1DCEF554523A67943CA053CEB4E65899EA353745CDDDEE735E5A
3844Gpbo.exeC:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.POWERPNT.14.1049.hxnbinary
MD5:174A712B20646E7A54F51B43B634B364
SHA256:B10BE2DD86FBBB34107CB34591431B9CC262A59783A3870B2021A5AAEACF898F
3844Gpbo.exeC:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MValidator.Lcktext
MD5:B485167C5B0E59D47009A16F90FE2659
SHA256:DB44B8DB4F05D720EF1A57ABADEED0C164D47B17416C7DD7D136D8F10FBA91C9
2124WScript.exeC:\Users\admin\AppData\Local\Temp\Gpbo.exeexecutable
MD5:258ED03A6E4D9012F8102C635A5E3DCD
SHA256:8639825230D5504FD8126ED55B2D7AEB72944FFE17E762801AAB8D4F8F880160
3844Gpbo.exeC:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1031.hxnbinary
MD5:38061A5BD58F41E730B9F7AECF8887D2
SHA256:E656B20C05E1B9CA2144922DB899E44098868B4BEEDC3D73EDB03D03BBBA8D02
3844Gpbo.exeC:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSTORE.14.1036.hxnbinary
MD5:26A6839130C5EBC585E61B75D1EA3701
SHA256:B4BE011E06E6289BFD6DC3110DA98016216780F86898183C33A5D2CA7708D9E6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
netwalker.vbs