KR033172A562700243.PDF.exe

General
Target

KR033172A562700243.PDF.exe

Filesize

789KB

Completed

21-04-2021 06:04

Score
10 /10
MD5

5ca9ea11f89e982fc93ad12e656648a8

SHA1

0d0bd9cb9549638218db8c3442a3047e25ffc9a9

SHA256

9a0550bcf1c770a3febe17adb59aa91717654e4d660fca29bd7ccff14da6256f

Malware Config

Extracted

Family netwire
C2

194.156.90.31:5008

Attributes
activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
APRL-WORK
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
Password
registry_autorun
false
startup_name
use_mutex
false
Signatures 8

Filter: none

Discovery
Persistence
  • NetWire RAT payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1840-68-0x0000000000400000-0x0000000000433000-memory.dmpnetwire
    behavioral1/memory/1840-69-0x000000000040242D-mapping.dmpnetwire
    behavioral1/memory/1840-71-0x0000000000400000-0x0000000000433000-memory.dmpnetwire
  • Netwire

    Description

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Suspicious use of SetThreadContext
    KR033172A562700243.PDF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1684 set thread context of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    852schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    KR033172A562700243.PDF.exe

    Reported IOCs

    pidprocess
    1684KR033172A562700243.PDF.exe
    1684KR033172A562700243.PDF.exe
    1684KR033172A562700243.PDF.exe
    1684KR033172A562700243.PDF.exe
    1684KR033172A562700243.PDF.exe
    1684KR033172A562700243.PDF.exe
    1684KR033172A562700243.PDF.exe
    1684KR033172A562700243.PDF.exe
    1684KR033172A562700243.PDF.exe
  • Suspicious use of AdjustPrivilegeToken
    KR033172A562700243.PDF.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1684KR033172A562700243.PDF.exe
  • Suspicious use of WriteProcessMemory
    KR033172A562700243.PDF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1684 wrote to memory of 8521684KR033172A562700243.PDF.exeschtasks.exe
    PID 1684 wrote to memory of 8521684KR033172A562700243.PDF.exeschtasks.exe
    PID 1684 wrote to memory of 8521684KR033172A562700243.PDF.exeschtasks.exe
    PID 1684 wrote to memory of 8521684KR033172A562700243.PDF.exeschtasks.exe
    PID 1684 wrote to memory of 15041684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 15041684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 15041684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 15041684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 15641684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 15641684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 15641684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 15641684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 17081684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 17081684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 17081684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 17081684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 16161684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 16161684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 16161684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 16161684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 1684 wrote to memory of 18401684KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
Processes 7
  • C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qZYahesl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp25F8.tmp"
      Creates scheduled task(s)
      PID:852
    • C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe
      "{path}"
      PID:1504
    • C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe
      "{path}"
      PID:1564
    • C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe
      "{path}"
      PID:1708
    • C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe
      "{path}"
      PID:1616
    • C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe
      "{path}"
      PID:1840
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmp25F8.tmp

                        MD5

                        b3228b1f5224b46085df8686bd92fd72

                        SHA1

                        e7250f9549296745af647942f5512ea9545cd674

                        SHA256

                        b6499d513bc88b52ec8ef6a6e760e63c0aabd6e111c3433666ffabb8e6d6dab2

                        SHA512

                        e3eb6acfc30f4c12071b6321f821a05efb940c720cff29c4112de9e408bebf456ef77e854c9370418dd7f82ecac63b17ba4157bf6d2497f8bc43b63fdd8c2903

                      • memory/852-66-0x0000000000000000-mapping.dmp

                      • memory/1684-62-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                      • memory/1684-63-0x0000000000630000-0x000000000063E000-memory.dmp

                      • memory/1684-64-0x0000000007EA0000-0x0000000007F5D000-memory.dmp

                      • memory/1684-65-0x0000000005230000-0x00000000052A9000-memory.dmp

                      • memory/1684-60-0x0000000000180000-0x0000000000181000-memory.dmp

                      • memory/1840-68-0x0000000000400000-0x0000000000433000-memory.dmp

                      • memory/1840-69-0x000000000040242D-mapping.dmp

                      • memory/1840-70-0x0000000075B31000-0x0000000075B33000-memory.dmp

                      • memory/1840-71-0x0000000000400000-0x0000000000433000-memory.dmp