Analysis
- max time kernel
118s - max time network
120s - platform
windows10_x64 - resource
win10 - submitted
29/08/2020, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
okay.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target okay.exe
- Size 811KB
- Sample200829-xnakkrtmcx
- SHA256 c1ffaaa3fad1741534ca46e6eb19dbafebc46932eecccef600f69a615d8e57ea
- MD5 fb28d6d9db65cc77da00452e9c8064ba
- SHA1 761ef1c41595b6bd29d96e793f24b43daf9ef0e6
- SHA512 5a743a252aaa8d8a642b83927ef7fc597b897cc13c7422975456fa118678e54110aeb565ba7ad77d5f94ab65e958d87636927b9464f1552518221a7dd89dceec
- MD5 SHA1 SHA512
Malware Config
Signatures
- NetWire RAT payload 5 IoCs
resource yara_rule behavioral2/memory/1468-8-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1468-8-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1468-9-0x000000000040242D-mapping.dmp netwire behavioral2/memory/1468-10-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1468-10-0x0000000000400000-0x0000000000433000-memory.dmp netwire - Executes dropped EXE 1 IoCs
pid Process 1272 tmp.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.exe.lnk okay.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3612 set thread context of 1468 3612 okay.exe 77 - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe - Delays execution with timeout.exe 1 IoCs
pid Process 3636 timeout.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 7a2444f1df7dd601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\FolderN\notepad.exe:Zone.Identifier cmd.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3612 okay.exe 3612 okay.exe 3612 okay.exe 3612 okay.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 492 svchost.exe Token: SeCreatePagefilePrivilege 492 svchost.exe Token: SeDebugPrivilege 3612 okay.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3612 wrote to memory of 1272 3612 okay.exe 76 PID 3612 wrote to memory of 1272 3612 okay.exe 76 PID 3612 wrote to memory of 1272 3612 okay.exe 76 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1468 3612 okay.exe 77 PID 3612 wrote to memory of 1516 3612 okay.exe 78 PID 3612 wrote to memory of 1516 3612 okay.exe 78 PID 3612 wrote to memory of 1516 3612 okay.exe 78 PID 3612 wrote to memory of 1472 3612 okay.exe 80 PID 3612 wrote to memory of 1472 3612 okay.exe 80 PID 3612 wrote to memory of 1472 3612 okay.exe 80 PID 3612 wrote to memory of 2204 3612 okay.exe 82 PID 3612 wrote to memory of 2204 3612 okay.exe 82 PID 3612 wrote to memory of 2204 3612 okay.exe 82 PID 3612 wrote to memory of 2664 3612 okay.exe 84 PID 3612 wrote to memory of 2664 3612 okay.exe 84 PID 3612 wrote to memory of 2664 3612 okay.exe 84 PID 2664 wrote to memory of 3636 2664 cmd.exe 86 PID 2664 wrote to memory of 3636 2664 cmd.exe 86 PID 2664 wrote to memory of 3636 2664 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\okay.exe"C:\Users\Admin\AppData\Local\Temp\okay.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"2⤵
- Executes dropped EXE
PID:1272
-
-
C:\Users\Admin\AppData\Local\Temp\okay.exe"C:/Users/Admin/AppData/Local/Temp/okay.exe"2⤵PID:1468
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/okay.exe" "%appdata%\FolderN\notepad.exe" /Y2⤵PID:1516
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\FolderN\notepad.exe:Zone.Identifier2⤵
- NTFS ADS
PID:1472
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "%appdata%\FolderN\notepad.exe.jpg" notepad.exe2⤵PID:2204
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderN\notepad.exe.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
PID:3636
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:492