Full Report
ELENOR-corp ransomware, a new version of Mimic, is targeting healthcare organizations using advanced capabilities
Analysis Summary
# Threat Actor: ELENOR-corp (Mimic Ransomware Variant 7.5)
## Attribution & Identity
**Name:** ELENOR-corp
**Known Aliases/Associations:** Identified as version 7.5 of the **Mimic ransomware** strain. No specific traditional threat actor group attribution is provided, but it operates as a targeted ransomware operation.
## Activity Summary
ELENOR-corp has been used in a series of targeted attacks against the **healthcare sector**. The campaign features advanced capabilities focused on data exfiltration, establishing persistent access, and employing anti-forensic measures to impede recovery efforts.
## Tactics, Techniques & Procedures
- **System Access & Execution:**
- Leverages the **sticky keys bypass technique** to achieve remote command execution without requiring user credentials.
- Ensures command-line access is maintained regardless of system restrictions.
- Deployment results in persistent registry entries.
- **Evasion & Anti-Forensics:**
- The executable is **obfuscated** to evade detection and complicate analysis.
- Aggressive evidence tampering: Deletes system logs and file indexing histories.
- Deletes registry entries.
- Uses `fsutil` commands to **overwrite and delete its own binaries**, severely limiting forensic recovery capabilities.
- **Data Handling & Persistence:**
- **Data exfiltration** is a core capability.
- Forcibly **dismounts virtual drives** to prevent attackers from hiding data in mounted environments.
- Displays a visible **ransom demand** specifically at the Windows login screen.
- **Operational Flexibility:**
- If .NET 4.0 is present, they utilize a GUI interface (`gui40.exe`) to **fine-tune encryption parameters**.
*(No specific MITRE ATT&CK IDs were provided in the summary text.)*
## Targeting
**Sectors:** Healthcare Sector
**Geography:** Not specified in the provided text.
**Victims:** Specific organizations were not named, only the targeted sector.
## Tools & Infrastructure
**Malware Families Used:** ELENOR-corp (a variant of Mimic ransomware)
**Infrastructure (C2, Domains, IPs):**
- `gui40.exe` (Used for GUI interface if .NET 4.0 is present)
- No specific C2 domains or IPs were provided.
## Implications
The emergence of ELENOR-corp (Mimic v7.5) indicates a highly advanced and evolving ransomware threat actively targeting critical infrastructure like healthcare. Its focus on aggressive anti-forensics (binary deletion, log wiping) and methods to bypass initial security controls (sticky keys bypass) suggests high operational maturity, aiming to maximize impact and recovery cost for victims.
## Mitigations
- Harden systems against registry persistence mechanisms.
- Monitor for unusual use of `fsutil` commands, especially those related to file overwriting or deletion.
- Implement robust logging and ensure centralized log storage that is protected from modification or deletion on the endpoint.
- Patch and update systems to prevent the introduction of ransomware via known vulnerabilities that enable remote command execution, particularly those related to bypassing credential requirements.
- Ensure backup strategies, including immutable or offline backups, are resilient to data manipulation efforts aimed at preventing recovery.