KR033172A562700243.PDF.exe

General
Target

KR033172A562700243.PDF.exe

Filesize

789KB

Completed

21-04-2021 06:04

Score
10 /10
MD5

5ca9ea11f89e982fc93ad12e656648a8

SHA1

0d0bd9cb9549638218db8c3442a3047e25ffc9a9

SHA256

9a0550bcf1c770a3febe17adb59aa91717654e4d660fca29bd7ccff14da6256f

Malware Config

Extracted

Family netwire
C2

194.156.90.31:5008

Attributes
activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
APRL-WORK
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
Password
registry_autorun
false
startup_name
use_mutex
false
Signatures 8

Filter: none

Discovery
Persistence
  • NetWire RAT payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/2772-126-0x0000000000400000-0x0000000000433000-memory.dmpnetwire
    behavioral2/memory/2772-127-0x000000000040242D-mapping.dmpnetwire
    behavioral2/memory/2772-128-0x0000000000400000-0x0000000000433000-memory.dmpnetwire
  • Netwire

    Description

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Suspicious use of SetThreadContext
    KR033172A562700243.PDF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 512 set thread context of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    4016schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    KR033172A562700243.PDF.exe

    Reported IOCs

    pidprocess
    512KR033172A562700243.PDF.exe
    512KR033172A562700243.PDF.exe
    512KR033172A562700243.PDF.exe
  • Suspicious use of AdjustPrivilegeToken
    KR033172A562700243.PDF.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege512KR033172A562700243.PDF.exe
  • Suspicious use of WriteProcessMemory
    KR033172A562700243.PDF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 512 wrote to memory of 4016512KR033172A562700243.PDF.exeschtasks.exe
    PID 512 wrote to memory of 4016512KR033172A562700243.PDF.exeschtasks.exe
    PID 512 wrote to memory of 4016512KR033172A562700243.PDF.exeschtasks.exe
    PID 512 wrote to memory of 2728512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2728512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2728512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
    PID 512 wrote to memory of 2772512KR033172A562700243.PDF.exeKR033172A562700243.PDF.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:512
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qZYahesl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7EEA.tmp"
      Creates scheduled task(s)
      PID:4016
    • C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe
      "{path}"
      PID:2728
    • C:\Users\Admin\AppData\Local\Temp\KR033172A562700243.PDF.exe
      "{path}"
      PID:2772
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmp7EEA.tmp

                        MD5

                        0e6bc0c8be74ddebc8e30c44e7cac2fc

                        SHA1

                        0f5b45070bd18ad2fc87183a3f685e8937a6f753

                        SHA256

                        a86f67266049224a7a5c1eb4be6489543db2848038df683c38e686f7002b13df

                        SHA512

                        66282a7d2e39d74c0950e68f12286e249452378e3f5af30f15db519bb2d5bdc479ec59ead12c5c3f276eaaddd3285adf5a15081030f8de33c7fa5c7671c613bd

                      • memory/512-114-0x00000000006A0000-0x00000000006A1000-memory.dmp

                      • memory/512-117-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                      • memory/512-118-0x0000000005120000-0x0000000005121000-memory.dmp

                      • memory/512-119-0x0000000004EF0000-0x0000000004F82000-memory.dmp

                      • memory/512-120-0x00000000054A0000-0x00000000054AE000-memory.dmp

                      • memory/512-121-0x0000000006A60000-0x0000000006A61000-memory.dmp

                      • memory/512-122-0x00000000086F0000-0x00000000087AD000-memory.dmp

                      • memory/512-123-0x000000000AEA0000-0x000000000AF19000-memory.dmp

                      • memory/512-116-0x00000000054C0000-0x00000000054C1000-memory.dmp

                      • memory/2772-126-0x0000000000400000-0x0000000000433000-memory.dmp

                      • memory/2772-127-0x000000000040242D-mapping.dmp

                      • memory/2772-128-0x0000000000400000-0x0000000000433000-memory.dmp

                      • memory/4016-124-0x0000000000000000-mapping.dmp