Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-06-2021 13:07
Static task
static1
Behavioral task
behavioral1
Sample
Nizi International S.A. #New Order.exe
Resource
win7v20210410
General
-
Target
Nizi International S.A. #New Order.exe
-
Size
468KB
-
MD5
4697f45d7a2c5e60372f8d9548d4b75a
-
SHA1
ee7ba79d497b776b301a7a233e1b84a325ba07b9
-
SHA256
42949a2f912c87695ebffdd714eae9ae470935a2323f75a937fa3521155b3701
-
SHA512
78b32bf01891c31307221223ad91f3a57c99766d80ba39b1d53fd454ff029542d5d094650e31fe7e440e5b99474e778730d131877cd8e8131c25ecbff922cb42
Malware Config
Extracted
netwire
sipex2021.ddns.net:8753
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2124-128-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2124-129-0x000000000040242D-mapping.dmp netwire behavioral2/memory/2124-139-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
MSBuild.exepid process 2124 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Nizi International S.A. #New Order.exedescription pid process target process PID 3908 set thread context of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
Nizi International S.A. #New Order.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings Nizi International S.A. #New Order.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Nizi International S.A. #New Order.exepowershell.exepid process 3908 Nizi International S.A. #New Order.exe 3908 Nizi International S.A. #New Order.exe 2464 powershell.exe 2464 powershell.exe 2464 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Nizi International S.A. #New Order.exepowershell.exedescription pid process Token: SeDebugPrivilege 3908 Nizi International S.A. #New Order.exe Token: SeDebugPrivilege 2464 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Nizi International S.A. #New Order.exeWScript.exedescription pid process target process PID 3908 wrote to memory of 2408 3908 Nizi International S.A. #New Order.exe WScript.exe PID 3908 wrote to memory of 2408 3908 Nizi International S.A. #New Order.exe WScript.exe PID 3908 wrote to memory of 2408 3908 Nizi International S.A. #New Order.exe WScript.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 3908 wrote to memory of 2124 3908 Nizi International S.A. #New Order.exe MSBuild.exe PID 2408 wrote to memory of 2464 2408 WScript.exe powershell.exe PID 2408 wrote to memory of 2464 2408 WScript.exe powershell.exe PID 2408 wrote to memory of 2464 2408 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nizi International S.A. #New Order.exe"C:\Users\Admin\AppData\Local\Temp\Nizi International S.A. #New Order.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Xpivccxvyw.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome\Google\chrome.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exeC:\Users\Admin\AppData\Local\Temp\MSBuild.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exeMD5
9af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Users\Admin\AppData\Local\Temp\_Xpivccxvyw.vbsMD5
dd324fe7f7eb1af18e2f0c011669c28d
SHA1f1c148fe260963d257eaba866de68ffc09b5ef32
SHA256192db1efb34c22fc3e03aab1f7c74bcfb263d57a75b25d90e1ea5e078207bb6f
SHA51257bc4417a7b458833b1a08c9e949102f336725669b970758bc23720257cb33decd95e42b65bcf259997b5c53ab60912433ac91cd9df674bf52a85e9b6cb3ad59
-
memory/2124-139-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2124-129-0x000000000040242D-mapping.dmp
-
memory/2124-128-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2408-126-0x0000000000000000-mapping.dmp
-
memory/2464-135-0x0000000007150000-0x0000000007151000-memory.dmpFilesize
4KB
-
memory/2464-140-0x0000000004770000-0x0000000004771000-memory.dmpFilesize
4KB
-
memory/2464-188-0x0000000004773000-0x0000000004774000-memory.dmpFilesize
4KB
-
memory/2464-167-0x0000000009550000-0x0000000009551000-memory.dmpFilesize
4KB
-
memory/2464-166-0x0000000009330000-0x0000000009331000-memory.dmpFilesize
4KB
-
memory/2464-161-0x000000007F390000-0x000000007F391000-memory.dmpFilesize
4KB
-
memory/2464-131-0x0000000000000000-mapping.dmp
-
memory/2464-134-0x0000000006AE0000-0x0000000006AE1000-memory.dmpFilesize
4KB
-
memory/2464-160-0x00000000091E0000-0x00000000091E1000-memory.dmpFilesize
4KB
-
memory/2464-136-0x00000000077C0000-0x00000000077C1000-memory.dmpFilesize
4KB
-
memory/2464-137-0x0000000007860000-0x0000000007861000-memory.dmpFilesize
4KB
-
memory/2464-138-0x0000000007B20000-0x0000000007B21000-memory.dmpFilesize
4KB
-
memory/2464-153-0x0000000009200000-0x0000000009233000-memory.dmpFilesize
204KB
-
memory/2464-145-0x0000000008210000-0x0000000008211000-memory.dmpFilesize
4KB
-
memory/2464-141-0x0000000004772000-0x0000000004773000-memory.dmpFilesize
4KB
-
memory/2464-142-0x0000000007B90000-0x0000000007B91000-memory.dmpFilesize
4KB
-
memory/2464-143-0x0000000007AF0000-0x0000000007AF1000-memory.dmpFilesize
4KB
-
memory/2464-144-0x0000000008460000-0x0000000008461000-memory.dmpFilesize
4KB
-
memory/3908-125-0x0000000007470000-0x00000000074D1000-memory.dmpFilesize
388KB
-
memory/3908-116-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/3908-114-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/3908-117-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/3908-118-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/3908-119-0x0000000004E40000-0x000000000533E000-memory.dmpFilesize
5.0MB
-
memory/3908-120-0x0000000005160000-0x00000000051B3000-memory.dmpFilesize
332KB