Ransom.Win32.NEMTY.THBOCBO

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• cmd.exe/c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=401MB;
• cmd.exe/c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=unbounded;
• cmd.exe/c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB;
• cmd.exe/c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded;
• cmd.exe/c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=401MB;
• cmd.exe/c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=unbounded;
• cmd.exe/c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB;
• cmd.exe/c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded;
• "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e {Base64 command};
• cmd.exe/c "{User Profile}\NEMTY_{7 random characters}-DECRYPT.txt";

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\NEMTY
fid = "_NEMTY_{7 random characters}_"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
daite drobovik = {Malware Name}.exe

Process Termination

This Ransomware terminates the following services if found on the affected system:

• DbxSvc
• OracleXETNSListener
• OracleServiceXE
• AcrSch2Svc
• AcronisAgent
• Apache2.4
• SQLWriter
• MSSQL$SQLEXPRESS
• MSSQLServerADHelper100
• MongoDB
• SQLAgent$SQLEXPRESS
• SQLBrowser
• CobianBackup11
• cbVSCService11

It terminates the following processes if found running in the affected system's memory:

• sql
• winword
• wordpad
• outlook
• thunderbird
• oracle
• excel
• onenote
• virtualboxvm

Other Details

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\NEMTY

It connects to the following URL(s) to get the affected system's IP address:

• www.myexternalip.com
• http://api.db-ip.com/v2/free/{external ip}/countryName
• It terminates itself if the location of the IP address is any of the following:
  • Russia
  • Belarus
  • Kazakhstan
  • Tajikistan
  • Ukraine
  • Azerbaijan
  • Armenia
  • Kyrgyzstan
  • Moldova

It connects to the following website to send and receive information:

• https://{BLOCKED}y10.hk/public/gate.php?data={configuration}

It does the following:

• It encrypts files in fixed, removable, and network drives.
• It will not proceed with its routine if found not running on any of the following:
  • Windows 7
  • Windows 8
  • Windows 8.1
  • Windows 10
  • Windows XP

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• windows
• $RECYCLE.BIN
• rsa
• NTDETECT.COM
• ntldr
• MSDOS.SYS
• IO.SYS
• boot.ini
• AUTOEXEC.BAT
• ntuser.dat
• desktop.ini
• CONFIG.SYS
• RECYCLER
• BOOTSECT.BAK
• bootmgr
• programdata
• appdata
• Common Files
• TorDir
• Program Files

It appends the following extension to the file name of the encrypted files:

• .NEMTY_{7 random characters}

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\NEMTY_{7 random characters}-DECRYPT.txt
  

It avoids encrypting files with the following file extensions:

• .lnk
• .exe
• .log
• .cab
• .cmd
• .com
• .cpl
• .exe
• .ini
• .dll
• .url
• .ttf
• .pif