00 — Background
The Case: A Phishing Email at DRUMBO Corp
An employee at DRUMBO Corporation received a phishing email masquerading as a message from their boss. The email featured the company logo, a familiar sender address, and an attachment that — once opened — deployed ransomware across the system, encrypting sensitive files.
Our job: trace the full attack chain from the initial phishing lure all the way through to the malware's behavior, persistence mechanisms, C2 communication, and threat actor attribution.
🔬 Investigation Scope
This is a
threat intelligence investigation — we're not just identifying that something bad happened, we're reconstructing
how it happened,
who is behind it, and
what their full capability set looks like. Every artifact is a data point in a larger adversary profile.
Key Facts
Target Organization
DRUMBO Corporation
Attack Type
Ransomware via Spear Phishing
Malware Family
BadRabbit (EternalPetya lineage)
Threat Actor
Sandworm (GRU Unit 74455)
01 — Phishing Analysis
Dissecting the Lure
The attack began with a carefully crafted spear phishing email. On the surface it looked legitimate — it used the company logo, appeared to come from a trusted sender, and created urgency around a contract document. Three classic social engineering ingredients.
The Spoofed Sender
The sender address was theceojamessmith@Drurnbo.com — at first glance identical to a legitimate internal address. Closer inspection revealed a one-letter typo: the actual company domain is Drumbo but the email came from Drurnbo (or a variant). A single character substitution — the kind of thing that gets missed in a busy inbox.
From: theceojamessmith@Drurnbo.com
Expected: theceojamessmith@Drumbo.com
🎣 Phishing Indicators — Email
Two clear indicators present: (1)
typosquatted sender domain — one character off from the legitimate address. (2)
Forced urgency — the email pressured the victim to download and open the attachment immediately, bypassing normal scrutiny. Both are documented social engineering TTPs.
The Attachment
The attachment was named Urgent Contract Action.pdf.exe — a double extension trick designed to appear as a PDF while actually being an executable. On default Windows configurations where file extensions are hidden, the victim would only see "Urgent Contract Action.pdf".
🚨 Masquerading Detected
Urgent Contract Action.pdf.exe — a
.exe binary masquerading as a PDF document. This is MITRE ATT&CK
T1036.007 — Masquerading: Double File Extension. Opening this file did not show a contract. It executed the ransomware payload.
02 — Static Analysis
ANY.RUN + VirusTotal — What Is This File?
Rather than executing the file directly, we opened it in ANY.RUN — a cloud-based interactive sandbox that runs the file in a controlled environment and captures every system call, network connection, and file operation in real time.
Initial Finding — Controlled Environment Analysis
ANY.RUN confirmed immediately that Urgent Contract Action.pdf.exe was not a PDF. It identified it as a malicious executable. We extracted the file and ran its SHA256 hash through VirusTotal.
File: Urgent Contract Action.pdf.exe
SHA256: 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
Malware Family: BadRabbit
Classification: Ransomware
Detection Rate: High — flagged by majority of AV engines
Attribution via Hash: The SHA256 lookup on VirusTotal confirmed this sample belongs to the BadRabbit ransomware family — a destructive strain first observed in October 2017, primarily targeting organizations in Russia and Ukraine, with secondary victims across Eastern Europe and Germany.
03 — Dynamic Analysis
What Happens When You Run It
Dynamic analysis in ANY.RUN revealed the full execution chain. The ransomware doesn't just encrypt files — it follows a multi-stage deployment process designed for maximum damage and lateral movement capability.
Stage 1 — The Dropper
Upon execution, the ransomware dropped a file called infpub.dat into the system. This is a malicious DLL — not a legitimate data file despite the .dat extension — which was then loaded and executed by rundll32.exe, Windows' own legitimate process for running DLL files.
⚠️ Living off the Land
Using
rundll32.exe to execute a malicious DLL is a classic
LOLBin (Living off the Land Binary) technique. The malware hijacks a legitimate Windows binary so its execution blends in with normal system activity, evading basic process monitoring.
Stage 2 — Lateral Movement via Mimikatz
Digging into infpub.dat revealed something significant: it uses Mimikatz — the well-known credential extraction tool — to brute-force NTLM login credentials against Windows machines with pseudo-random IP addresses across the network.
The DLL contained a hardcoded list of username/password combinations to try. Reviewing this list, one username stood out as suspiciously specific: "alex" — not a generic term like "admin" or "user", suggesting targeted intelligence about the victim environment.
Administrator, Admin, Guest, User, User1, user-1
Test, root, buh, boss, ftp, rdp, rdpuser, rdpadmin
manager, support, work, other user, operator, backup
asus, ftpuser, ftpadmin, nas, nasuser, nasadmin
superuser, netguest, alex
Stage 3 — C2 Communication
The ransomware communicated with a command and control server using web protocols over standard HTTP/S — specifically sub-technique T1071.001 in the MITRE ATT&CK framework. Using common web protocols makes C2 traffic blend in with normal browsing activity, making detection harder at the network layer.
Stage 4 — Persistence via Scheduled Tasks
Two scheduled tasks were created on the infected system to maintain persistence and orchestrate the final payload execution:
Scheduled Task 1
"rhaegal" — executes dispci.exe on system startup
Scheduled Task 2
"drogon" — initiates a forced system shutdown
🐉 Game of Thrones Naming Convention
Both task names —
rhaegal and
drogon — are dragons from Game of Thrones. This is consistent with documented BadRabbit behavior; the malware's authors used GoT references throughout. The WannaCry authors used similar pop culture references. Naming conventions in malware are sometimes used as attribution fingerprints across campaigns.
The drogon task's forced shutdown behavior serves a dual purpose: disrupting normal operations to mask malware activity, and forcing a reboot that triggers the MBR-level encryption on next startup.
04 — The Kill Stage
dispci.exe — MBR Corruption
The Cisco Talos malware analysis report on BadRabbit revealed the full picture of dispci.exe — the most destructive component of the attack chain.
Upon execution, dispci.exe displays the following message to the victim:
"Disable your anti-virus and anti-malware programs"
Oops! Your files have been encrypted.
If you see this text, your files are no longer accessible.
Visit our web service at caforsssztxqzf2nm.onion
Your personal installation key#2: [key]
What dispci.exe Actually Does
SHA256 analysis of the dispci.exe executable on VirusTotal revealed its copyright is owned by http://diskcryptor.net — a legitimate disk encryption tool. BadRabbit's authors modified DiskCryptor to serve as their encryption engine.
The modified binary is specifically designed to:
Primary Action
Modify the Master Boot Record (MBR)
Secondary Action
Encrypt the victim's entire hard drive
Exploit Used
EternalRomance (SMB exploit)
💀 MBR-Level Destruction
Corrupting the MBR means the system
cannot boot at all after reboot — the victim sees only the ransom note instead of Windows. This is not just file-level encryption like typical ransomware. It's full system destruction unless the ransom is paid. MITRE ATT&CK classifies this as
T1495 — Firmware Corruption.
05 — Full Attack Chain
Reconstructing the Kill Chain
Spear Phishing Email Delivered
Victim receives email appearing to be from CEO (james.smith@Drurnbo.com — typosquatted domain). Company logo included. Urgent contract attachment triggers download.
T1566.001 — Phishing: Spearphishing Attachment
Masqueraded Executable Opened
Victim opens "Urgent Contract Action.pdf.exe" believing it to be a PDF. Double extension trick bypasses visual inspection. Ransomware payload executes.
T1036.007 — Masquerading: Double File Extension
infpub.dat Dropped & Executed
Malicious DLL dropped to disk. Loaded via rundll32.exe — legitimate Windows binary — to blend execution with normal system activity.
T1218.011 — Signed Binary Proxy: Rundll32
NTLM Credential Brute Force
infpub.dat uses Mimikatz to brute-force NTLM credentials against machines on pseudo-random IPs. Hardcoded credential list includes generic and targeted usernames including "alex".
T1110.001 — Brute Force: Password Guessing
C2 Communication Established
Ransomware phones home to C2 server using standard web protocols over HTTP/S — traffic blends in with legitimate browsing, evading network-level detection.
T1071.001 — Application Layer Protocol: Web Protocols
Persistence — Scheduled Tasks Created
Two scheduled tasks installed: "rhaegal" (executes dispci.exe on boot) and "drogon" (forces system shutdown). Persistence survives reboot; shutdown forces MBR encryption to trigger.
T1053.005 — Scheduled Task/Job
MBR Corruption & Full Disk Encryption
dispci.exe (modified DiskCryptor) overwrites the Master Boot Record and encrypts the victim's hard drive. On reboot, system is non-functional — only the ransom note is displayed via the .onion payment portal.
T1495 — Firmware Corruption
06 — Threat Actor Attribution
Who Is Behind BadRabbit?
The malware analysis trail — combined with research via Malpedia — points to a well-documented and dangerous threat actor.
// Attributed Threat Actor
Sandworm
Also known as: GRU Unit 74455 · Voodoo Bear · TeleBots · Iron Viking
Sandworm is a Russian nation-state threat actor widely attributed to the GRU (Russian military intelligence). They are responsible for some of the most destructive cyberattacks in history — including the 2015 and 2016 Ukrainian power grid attacks, NotPetya, and Olympic Destroyer. BadRabbit is part of the EternalPetya threat actor group, which Malpedia links directly to Sandworm's operational infrastructure and tooling patterns.
🔗 Attribution Chain
BadRabbit → EternalPetya family → Sandworm (GRU Unit 74455). The connection is established through shared code similarities with NotPetya, overlapping C2 infrastructure, identical MBR corruption techniques, and the use of EternalRomance — the same NSA-leaked SMB exploit used in previous Sandworm operations.
07 — MITRE ATT&CK Mapping
Techniques Observed
T1566.001
Spearphishing Attachment
Initial access via targeted phishing email with malicious attachment
T1036.007
Double File Extension
.pdf.exe masquerading to trick victim into executing binary
T1218.011
Signed Binary Proxy: Rundll32
infpub.dat loaded via legitimate rundll32.exe to evade detection
T1110.001
Password Guessing
Mimikatz-based NTLM brute force with hardcoded credential list
T1071.001
Web Protocols C2
C2 communication over HTTP/S to blend with legitimate traffic
T1053.005
Scheduled Task
rhaegal + drogon tasks for persistence and shutdown trigger
T1495
Firmware Corruption
MBR overwrite via modified DiskCryptor to prevent booting
T1486
Data Encrypted for Impact
Full disk encryption rendering data inaccessible without decryption key
08 — IOC Summary
Indicators of Compromise
| Indicator |
Value |
Type |
Confidence |
| Malicious Attachment |
Urgent Contract Action.pdf.exe |
File |
HIGH |
| Spoofed Sender Domain |
Drurnbo.com (vs legitimate Drumbo.com) |
Domain |
HIGH |
| Dropped DLL |
infpub.dat |
File |
HIGH |
| Encryption Binary |
dispci.exe (modified DiskCryptor) |
File |
HIGH |
| Scheduled Task |
rhaegal — startup persistence |
Persistence |
HIGH |
| Scheduled Task |
drogon — forced shutdown |
Persistence |
HIGH |
| C2 Payment Portal |
caforsssztxqzf2nm.onion |
Network |
HIGH |
| Malware Family |
BadRabbit / EternalPetya lineage |
Attribution |
HIGH |
| Threat Actor |
Sandworm (GRU Unit 74455) |
Actor |
MEDIUM-HIGH |
| Suspicious Username |
alex — in hardcoded brute force list |
Credential |
MEDIUM |
09 — Takeaways
What This Investigation Teaches Us
One Character Can Compromise an Entire Organization
The entire attack hinged on a single-letter typo in a domain name. Drurnbo.com vs Drumbo.com. Under time pressure, in a busy workday, that's an easy miss. This is why email security controls — DMARC, DKIM, SPF — and employee awareness training are non-negotiable.
Hash Lookup Is Your Fastest Attribution Tool
Extracting the attachment and running its SHA256 on VirusTotal took minutes and immediately connected us to the BadRabbit family. For any unknown file in an investigation, hash lookup should be the first step — it either closes the case fast or tells you what rabbit hole you're going down.
Dynamic Analysis Reveals What Static Analysis Misses
The infpub.dat drop, the Mimikatz credential brute force, the scheduled tasks — none of these would have been visible from static analysis of the original attachment. ANY.RUN's sandbox showed us the full behavior chain that only manifests at runtime. Static + dynamic together is the complete picture.
Nation-State TTPs Leave Fingerprints
The GoT naming convention, the EternalRomance exploit, the MBR corruption technique — individually these are just data points. Together they form a behavioral signature that connects BadRabbit to Sandworm's broader operational pattern. Threat intel is about recognizing those patterns across campaigns, not just analyzing isolated samples.
Tools Used — This Investigation
ANY.RUN — Interactive sandbox for safe execution & behavior analysis
VirusTotal — SHA256 hash lookup & malware family attribution
Malpedia — Threat actor research & malware family mapping
Cisco Talos / Securelist — Third-party malware analysis reports
MITRE ATT&CK — TTP mapping & technique identification