{"id":60147,"date":"2019-04-29T09:00:24","date_gmt":"2019-04-29T01:00:24","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=60147"},"modified":"2019-04-08T12:04:37","modified_gmt":"2019-04-08T04:04:37","slug":"%e8%b6%a8%e5%8b%a2%e7%a7%91%e6%8a%80mdr%e8%a8%97%e7%ae%a1%e5%bc%8f%e5%81%b5%e6%b8%ac%e5%8f%8a%e5%9b%9e%e6%87%89%e6%9c%8d%e5%8b%99%e7%99%bc%e7%8f%beemotet%e6%95%a3%e6%92%ad%e7%9a%84nozelesn%e5%8b%92","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=60147","title":{"rendered":"\u8da8\u52e2\u79d1\u6280MDR(\u8a17\u7ba1\u5f0f\u5075\u6e2c\u53ca\u56de\u61c9\u670d\u52d9)\u767c\u73feEmotet\u6563\u64ad\u7684Nozelesn\u52d2\u7d22\u75c5\u6bd2\u8f09\u5165\u7a0b\u5f0f"},"content":{"rendered":"\n
\"\"\/<\/figure><\/div>\n\n\n\n

\u900f\u904e\u8da8\u52e2\u79d1\u6280\u7684\u8a17\u7ba1\u5f0f\u5075\u6e2c\u53ca\u56de\u61c9(Managed Detection and Response<\/em>\uff0c\u7c21\u7a31MDR)\u00a0<\/a>\u76e3\u63a7\uff0c\u6211\u5011\u767c\u73fe\u4e86\u6a21\u7d44\u5316\u7684Emotet\u60e1\u610f\u8edf\u9ad4\u5728\u6563\u64adNymaim\u60e1\u610f\u8edf\u9ad4\uff0c\u5f8c\u8005\u63a5\u8457\u6703\u8f09\u5165Nozelesn<\/a>\u52d2\u7d22\u75c5\u6bd2\u3002\u6211\u50112019\u5e742\u6708\u5728\u4e00\u9593\u98ef\u5e97\u7684\u76e3\u63a7\u7aef\u9ede\u4e0a\u5075\u6e2c\u5230\u4e86\u9019\u96bbEmotet\u8b8a\u7a2e\u3002\u70ba\u4e86\u8fd1\u4e00\u6b65\u8abf\u67e5\uff0c\u6211\u5011\u53d6\u5f97\u4e86580\u500b\u985e\u4f3c\u7684Emotet\u9644\u4ef6\u6a94\uff0c\u4e26\u6536\u96c6\u5f9e2019\u5e741\u67089\u65e5\u52302019\u5e742\u67087\u65e5\u9593\u7684\u8cc7\u6599\u3002<\/p>\n\n\n\n

\u5a01\u8105\u8abf\u67e5<\/strong><\/h4>\n\n\n\n

\u57282\u670811\u65e5\uff0c\u6211\u5011\u958b\u59cb\u8abf\u67e5\u5728MDR\u76e3\u63a7\u7aef\u9ede\u6240\u770b\u5230\u7684\u4e00\u8d77Emotet\u5075\u6e2c\u4e8b\u4ef6\u3002\u70ba\u4e86\u4fbf\u65bc\u5206\u6790\uff0c\u6211\u5011\u5c07\u6b64\u7aef\u9ede\u7a31\u70baEP01\u3002\u5728\u521d\u6b65\u8abf\u67e5\u6642\u6211\u5011\u6ce8\u610f\u5230\u4e0b\u5217\u53ef\u7591\u6a94\u6848\uff1a<\/p>\n\n\n\n\n\n\n\n
\n \u4e3b\u6a5f<\/strong>\n <\/td>\n \u6642\u9593<\/strong>\n <\/td>\n \u6a94\u6848\u8def\u5f91<\/strong>\n <\/td>\n \u8a3b\u8a18<\/strong>\n <\/td><\/tr>
\n EP01\n <\/td>\n 2\/11\/19\n 11:10 a.m. CST\n <\/td>\n C:\\Users\\{username}\\Downloads\\636493431.doc\n <\/td>\n Powload\n <\/td><\/tr>
\n EP01\n <\/td>\n 2\/11\/19 
\n 11:15 a.m. CST\n <\/td>		\n C:\\Users\\{username}\\942.exe\n <\/td>\n Emotet\n <\/td><\/tr>
\n EP01\n <\/td>\n 2\/11\/19 
\n 11:15 a.m. CST\n <\/td>		\n C:\\Users\\{username}\\AppData\\Local\\indexerneutral\\indexerneutral.exe\n <\/td>\n Emotet\n <\/td><\/tr>
\n EP01\n <\/td>\n 2\/11\/19 
\n 11:17 a.m. CST\n <\/td>		\n C:\\ProgramData\\kdPZBXZIE4OUI3CMIrJ.exe\n <\/td>\n Nymaim\n <\/td><\/tr>
\n EP01\n <\/td>\n 2\/11\/19 
\n 11:15 a.m. CST\n <\/td>		\n C:\\ProgramData\\BHB2pT1jmhQdvC8236r.exe \n <\/td>\n Nymaim\n <\/td><\/tr><\/tbody><\/table>\n\n\n\n

\u6ce8\u610f\uff1a\u9019\u4e9b\u662f\u6211\u5011\u5728\u64b0\u5beb\u6b64\u5206\u6790\u6642\u767c\u73fe\u7684\u5165\u4fb5\u6307\u6a19\u3002\u672c\u6587\u6700\u5f8c\u6703\u63d0\u4f9b\u96dc\u6e4a\u503c\u548c\u5075\u6e2c\u540d\u7a31\u3002<\/em><\/p>\n\n\n\n

\u88681. Emotet\u60e1\u610f\u8edf\u9ad4\u611f\u67d3\u6642\u9593\u8868<\/p>\n\n\n\n

\u7576\u6211\u5011\u89c0\u5bdf\u53ef\u80fd\u88ab\u518d\u6b21\u611f\u67d3\u7684\u74b0\u5883\u6642\uff0c\u6211\u5011\u5728\u53e6\u4e00\u500b\u7aef\u9ede\u4e0a\u627e\u5230\u540d\u70baHow_Fix_Nozelesn_files.htm\u7684\u6a94\u6848 \u2013 \u9019\u6b21\u662f\u5728\u4f3a\u670d\u5668\u4e0a\u3002\u70ba\u4e86\u4fbf\u65bc\u8a0e\u8ad6\uff0c\u6211\u5011\u7a31\u6b64\u4f3a\u670d\u5668\u70baS01\u3002S01\u51fa\u73fe\u4e86Nozelesn\u52d2\u7d22\u75c5\u6bd2\u7684\u611f\u67d3\u8de1\u8c61\uff0c\u4e26\u4e14\u6a94\u6848\u4f3c\u4e4e\u662f\u57282\u670815\u65e5\u5de6\u53f3\u5beb\u5165\u78c1\u789f\u3002\u6211\u5011\u9032\u4e00\u6b65\u9a57\u8b49\u4e86\u9019\u4e9b\u6d3b\u52d5\uff0c\u4e26\u767c\u73fe\u6709\u591a\u8d77\u76f8\u95dc\u7684\u6d3b\u52d5\u3002\u70ba\u4e86\u6df1\u5165\u4e86\u89e3\uff0c\u6211\u5011\u5728EP01\u4e0a\u9032\u884c\u7b2c\u4e8c\u6b21\u7684\u8abf\u67e5\uff0c\u4e5f\u5c31\u662f\u6839\u672c\u539f\u56e0\u5206\u6790\uff08RCA\uff09\u3002<\/p>\n\n\n\n

\u5206\u6790<\/em><\/strong><\/h4>\n\n\n\n
\"\u57161.

\u57161. Emotet\u60e1\u610f\u8edf\u9ad4\u611f\u67d3\u7684RCA\u5716\u8868 <\/figcaption><\/figure>\n\n\n\n

\u6839\u64daRCA\uff0c\u60e1\u610f\u6587\u4ef6\u6a94\u662f\u7528Chrome\u700f\u89bd\u5668\u4e0b\u8f09\u4e26\u4ee5Microsoft Word\u958b\u555f\u3002\u6211\u5011\u77e5\u9053\u8a72\u7d44\u7e54\u4f7f\u7528\u7684\u662fOffice\n365\uff0c\u56e0\u6b64\u9019\u7b26\u5408\u4ed6\u5011\u7684\u65e5\u5e38\u64cd\u4f5c\u3002\u6253\u958b\u60e1\u610f\u6587\u4ef6\u5f8c\u6703\u7acb\u5373\u547c\u53ebPowerShell.exe<\/em>\u3002\u5b83\u6703\u9023\u5230\u591a\u500bIP\u5730\u5740\uff0c\u6700\u7d42\u5728\u7cfb\u7d71\u5167\u7522\u751f\u53e6\u4e00\u500b\u540d\u70ba942.exe\u7684\u6a94\u6848\u3002<\/p>\n\n\n\n

\"\u57162.

\u57162. \u986f\u793a\u6703\u9023\u5230\u591a\u500bIP\u5730\u5740\u4e26\u7522\u751f942.exe\u6a94\u6848\u7684PowerShell\u8173\u672c <\/figcaption><\/figure>\n\n\n\n

\u4e3b\u8981\u88ab\u5075\u6e2c\u5230\u7684\u5143\u4ef6indexerneutral.exe<\/em>\u5176\u5be6\u662f942.exe\u642c\u79fb\u904e\u7684\u7d50\u679c\uff0c\u9019\u662fEmotet\u7684\u4e3b\u8981\u5143\u4ef6\u3002\u5b83\u6703\u6ce8\u5165explorer.exe\u7a0b\u5e8f\u4f86\u8b93\u81ea\u5df1\u99d0\u7559\u5728\u8a18\u61b6\u9ad4\u5167\u3002\u6839\u64da\u5176\u884c\u70ba\uff0c\u60e1\u610f\u8edf\u9ad4\u53ef\u80fd\u6703\u9023\u5230\u591a\u500bIP\u5730\u5740\u4f86\u4e0b\u8f09\u5176\u4ed6\u60e1\u610f\u8edf\u9ad4\u57f7\u884c\u3002\u5728\u6b64\u6848\u4f8b\u4e2d\uff0c\u6211\u5011\u767c\u73fe\u5b83\u9084\u6703\u4e0d\u65b7\u4e0b\u8f09\u81ea\u5df1\u7684\u66f4\u65b0\uff0c\u6bcf\u6b21\u90fd\u6703\u9023\u5230\u4e00\u7d44\u65b0\u7684\u547d\u4ee4\u548c\u63a7\u5236\uff08C&C\uff09\u4f3a\u670d\u5668\u3002\u9664\u4e86\u66f4\u65b0Emotet\u8b8a\u7a2e\u5916\uff0c\u5b83\u9084\u6703\u5efa\u7acb\u5169\u500b\u5e36\u6709\u96a8\u6a5f\u6a94\u540d\u7684\u6a94\u6848\uff08\u5982\u88681\u4e2d\u7684\u521d\u59cb\u6307\u6a19\u6240\u793a\uff09\uff0c\u6211\u5011\u5c07\u5176\u8b58\u5225\u70ba\u6b21\u8981\u60e1\u610f\u8ca0\u8377\u3002\u8981\u6ce8\u610f\u7684\u662f\uff0c\u5728\u76f8\u540c\u6642\u9593\u7bc4\u570d\u5167\uff0c\u6709\u8a31\u591a\u5176\u4ed6\u6b21\u8981\u60e1\u610f\u8ca0\u8377\u5728EP01\u7684\u4e0d\u540c\u4f4d\u7f6e\u7522\u751f\uff08\u5373gigabit-8.exe\uff0cwcdma-78.exe\u7b49\uff09\uff0c\u5982\u4e0b\u6240\u793a\uff1a<\/p>\n\n\n\n
\n \u6b21\u8981\u60e1\u610f\u8ca0\u8377<\/strong>\n <\/td><\/tr>
\n C:\\ProgramData\\blvds-45\\blvds-38.exe\n <\/td><\/tr>
\n C:\\Users\\{username}\\AppData\\Roaming\\flywheel-7\\flywheel-3.exe\n <\/td><\/tr>
\n C:\\Users\\{username}\\AppData\\Roaming\\gigabit-4\\gigabit-8.exe\n <\/td><\/tr>
\n C:\\Users\\{username}\\AppData\\Local\\ammeter-7\\ammeter-66.exe\n <\/td><\/tr>
\n C:\\Users\\{username}\\AppData\\Roaming\\debounce-6\\debounce-7.exe\n <\/td><\/tr>
\n C:\\Users\\{username}\\AppData\\Local\\wcdma-15\\wcdma-78.exe\n <\/td><\/tr><\/tbody><\/table>\n\n\n\n

\u88682. \u6b21\u8981\u60e1\u610f\u8ca0\u8377\u6a23\u672c<\/p>\n\n\n\n

\u6211\u5011\u6ce8\u610f\u5230\u6b21\u8981\u60e1\u610f\u8ca0\u8377\u8207Nymaim\u6709\u76f8\u4f3c\u7684\u6a94\u6848\u547d\u540d\u6a21\u5f0f\u548c\u884c\u70ba\uff0c\u6211\u5011\u548c\u5176\u4ed6\u8cc7\u5b89\u7814\u7a76\u4eba\u54e1\u57282018\u5e74\u9032\u884c\u5206\u6790\u6642\u8207Nozelesn\u52d2\u7d22\u75c5\u6bd2\u9023\u7d50<\/a>\u5728\u4e00\u8d77\u3002Nozelesn\u52d2\u7d22\u75c5\u6bd2\u88ab\u7528\u57282018\u5e747\u6708\u91dd\u5c0d\u6ce2\u862d\u7684\u653b\u64ca\u6d3b\u52d5\uff0c\u4f7f\u7528\u526f\u6a94\u540d\u201c.nozelesn\u201d\u52a0\u5bc6\u6a94\u6848\uff0c\u4e26\u4e14\u6703\u7522\u751f\u4e00\u4efd\u6a94\u540d\u70baHOW_FIX_NOZELESN_FILES.htm<\/em>\u7684\u52d2\u8d16\u901a\u77e5\u3002\u96d6\u7136\u6c92\u6709\u627e\u5230Nozelesn\u52d2\u7d22\u75c5\u6bd2\u6a23\u672c\uff0c\u4f46\u8da8\u52e2\u79d1\u6280Smart Protection Network\u7684\u8cc7\u6599\u5c07\u8a72\u6d3b\u52d5\u8207Nymaim\u76f8\u95dc\u806f\uff0c\u5f8c\u8005\u662f\u4e00\u7a2e\u60e1\u610f\u8edf\u9ad4\u4e0b\u8f09\u7a0b\u5f0f\u3002\u5728\u6b64\u6848\u4f8b\u4e2d\uff0c\u6211\u5011\u61f7\u7591Nymaim\u53ef\u80fd\u5df2\u7d93\u4e0b\u8f09\u4e86Nozelesn\u52d2\u7d22\u75c5\u6bd2\uff0c\u4e26\u4f7f\u7528\u7121\u6a94\u6848\u57f7\u884c\u65b9\u5f0f\u5c07\u52d2\u7d22\u75c5\u6bd2\u8f09\u5165\u7cfb\u7d71\u8a18\u61b6\u9ad4\u3002<\/p>\n\n\n\n

RCA\u7d50\u679c\u53e6\u4e00\u500b\u503c\u5f97\u6ce8\u610f\u7684\u5730\u65b9\u662fEmotet\u80fd\u5920\u900f\u904e\u7ba1\u7406\u5171\u7528\u5c07\u81ea\u5df1\u8907\u88fd\u5230\u7db2\u8def\u5167\u7684\u591a\u53f0\u96fb\u8166\u3002indexerneutral.exe<\/em>\u6703\u4ee5[8<\/em>\u4f4d\u6578].exe<\/em>\u7684\u683c\u5f0f\u6563\u64ad\u5230\\\\{host}\\ADMIN$\\\u3002<\/p>\n\n\n\n

\u6839\u64da\u9019\u4e9b\u8cc7\u6599\uff0c\u6211\u5011\u63d0\u51fa\u5169\u7a2eS01<\/strong>\u5982\u4f55\u88abNozelesn\u52d2\u7d22\u75c5\u6bd2\u653b\u64ca\u7684\u53ef\u80fd\u60c5\u5883\uff1a<\/p>\n\n\n\n

  1. Emotet\u900f\u904e\u7ba1\u7406\u5171\u7528\u88ab\u8907\u88fd\u5230S01<\/strong>\u4e26\u57f7\u884c\u3002\u63a5\u8457\uff0cS01<\/strong>\u5167\u7684Emotet\u4e0b\u8f09\u4e86Nymaim\u60e1\u610f\u8edf\u9ad4\uff0c\u5f8c\u8005\u53c8\u5c07Nozelesn\u52d2\u7d22\u75c5\u6bd2\u8f09\u5165\u8a18\u61b6\u9ad4\u3002\u6216\u8005\u662f<\/li>
  2. Nymaim\u5728EP01<\/strong>\u4e2d\u8f09\u5165Nozelesn\u52d2\u7d22\u75c5\u6bd2\uff0c\u7136\u5f8c\u900f\u904e\u5171\u4eab\u8cc7\u6599\u593e\u52a0\u5bc6\u4e86S01<\/strong>\u7684\u6a94\u6848\u3002<\/li><\/ol>\n\n\n\n

    \u6211\u5011\u5728\u9019\u5169\u7a2e\u53ef\u80fd\u4e2d\u66f4\u50be\u5411\u65bc\u7b2c\u4e00\u7a2e\uff0c\u56e0\u70ba\u6211\u5011\u7684\u76e3\u63a7\u6c92\u6709\u986f\u793aEP01\u906d\u5230Nozelesn\u52d2\u7d22\u75c5\u6bd2\u611f\u67d3\u7684\u8de1\u8c61\u3002<\/p>\n\n\n\n

    \u8abf\u67e5\u7d50\u679c\u91cd\u9ede<\/strong><\/h4>\n\n\n\n

    \u4ee5\u4e0b\u662f\u6211\u5011\u8abf\u67e5\u7d50\u679c\u7684\u91cd\u9ede\uff0c\u5305\u62ec\u6211\u5011\u5728MDR\u5ba2\u6236\u7aef\u5075\u6e2c\u6536\u96c6\u7684\u8cc7\u6599\u3002<\/p>\n\n\n\n