Analysis
-
max time kernel
93s -
max time network
161s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
12-07-2021 11:03
Static task
static1
Behavioral task
behavioral1
Sample
P-Order.scr.exe
Resource
win7v20210408
General
-
Target
P-Order.scr.exe
-
Size
876KB
-
MD5
6cf82e76161361d385c53652fdba1992
-
SHA1
642276d01e7d4c7fc2fa8202025173b8abb3c221
-
SHA256
57d5c01633ef2f845946bf397ef571ba5c0e0afaafce8756d7811d7569f4b024
-
SHA512
939b26dc20dde77729f9d1ecfb9495b6bcce5a7514a44e87b2bee3dd427b967e568162b2c18e6850bbb92616452739b247e102b74f8c40bda8cad1fcc8277331
Malware Config
Extracted
netwire
harold.ns01.info:3606
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
false
-
host_id
prim
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
eApkLVIW
-
offline_keylogger
true
-
password
master12
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1452-67-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1452-68-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1452-72-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/324-84-0x000000000040242D-mapping.dmp netwire behavioral1/memory/324-87-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1240 Host.exe 324 Host.exe -
Loads dropped DLL 1 IoCs
Processes:
P-Order.scr.exepid process 1452 P-Order.scr.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
P-Order.scr.exeHost.exedescription pid process target process PID 676 set thread context of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 1240 set thread context of 324 1240 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1456 schtasks.exe 1908 schtasks.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
P-Order.scr.exeP-Order.scr.exeHost.exedescription pid process target process PID 676 wrote to memory of 1456 676 P-Order.scr.exe schtasks.exe PID 676 wrote to memory of 1456 676 P-Order.scr.exe schtasks.exe PID 676 wrote to memory of 1456 676 P-Order.scr.exe schtasks.exe PID 676 wrote to memory of 1456 676 P-Order.scr.exe schtasks.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 676 wrote to memory of 1452 676 P-Order.scr.exe P-Order.scr.exe PID 1452 wrote to memory of 1240 1452 P-Order.scr.exe Host.exe PID 1452 wrote to memory of 1240 1452 P-Order.scr.exe Host.exe PID 1452 wrote to memory of 1240 1452 P-Order.scr.exe Host.exe PID 1452 wrote to memory of 1240 1452 P-Order.scr.exe Host.exe PID 1240 wrote to memory of 1908 1240 Host.exe schtasks.exe PID 1240 wrote to memory of 1908 1240 Host.exe schtasks.exe PID 1240 wrote to memory of 1908 1240 Host.exe schtasks.exe PID 1240 wrote to memory of 1908 1240 Host.exe schtasks.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe PID 1240 wrote to memory of 324 1240 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xEjeDK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD70D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\P-Order.scr.exe"{path}"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xEjeDK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B98.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5B98.tmpMD5
a4fa600b499ce8d1a5131d7079c00836
SHA14841ca9ca6f77806b517399c41fd80cc870427e2
SHA25622119debad9e041943c8bbbc2b9da98a4e687c632a8e49178341a0c7f2d4d581
SHA5127bd282f2c76c1cf1511680672033cfabbefcbbdf5ec62fa5ea79738fdb1dfa81403bec664da6d28517665b521f526e7822b8e7c6cc5492ee1669afd69f6bf377
-
C:\Users\Admin\AppData\Local\Temp\tmpD70D.tmpMD5
a4fa600b499ce8d1a5131d7079c00836
SHA14841ca9ca6f77806b517399c41fd80cc870427e2
SHA25622119debad9e041943c8bbbc2b9da98a4e687c632a8e49178341a0c7f2d4d581
SHA5127bd282f2c76c1cf1511680672033cfabbefcbbdf5ec62fa5ea79738fdb1dfa81403bec664da6d28517665b521f526e7822b8e7c6cc5492ee1669afd69f6bf377
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
6cf82e76161361d385c53652fdba1992
SHA1642276d01e7d4c7fc2fa8202025173b8abb3c221
SHA25657d5c01633ef2f845946bf397ef571ba5c0e0afaafce8756d7811d7569f4b024
SHA512939b26dc20dde77729f9d1ecfb9495b6bcce5a7514a44e87b2bee3dd427b967e568162b2c18e6850bbb92616452739b247e102b74f8c40bda8cad1fcc8277331
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
6cf82e76161361d385c53652fdba1992
SHA1642276d01e7d4c7fc2fa8202025173b8abb3c221
SHA25657d5c01633ef2f845946bf397ef571ba5c0e0afaafce8756d7811d7569f4b024
SHA512939b26dc20dde77729f9d1ecfb9495b6bcce5a7514a44e87b2bee3dd427b967e568162b2c18e6850bbb92616452739b247e102b74f8c40bda8cad1fcc8277331
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
6cf82e76161361d385c53652fdba1992
SHA1642276d01e7d4c7fc2fa8202025173b8abb3c221
SHA25657d5c01633ef2f845946bf397ef571ba5c0e0afaafce8756d7811d7569f4b024
SHA512939b26dc20dde77729f9d1ecfb9495b6bcce5a7514a44e87b2bee3dd427b967e568162b2c18e6850bbb92616452739b247e102b74f8c40bda8cad1fcc8277331
-
\Users\Admin\AppData\Roaming\Install\Host.exeMD5
6cf82e76161361d385c53652fdba1992
SHA1642276d01e7d4c7fc2fa8202025173b8abb3c221
SHA25657d5c01633ef2f845946bf397ef571ba5c0e0afaafce8756d7811d7569f4b024
SHA512939b26dc20dde77729f9d1ecfb9495b6bcce5a7514a44e87b2bee3dd427b967e568162b2c18e6850bbb92616452739b247e102b74f8c40bda8cad1fcc8277331
-
memory/324-87-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/324-84-0x000000000040242D-mapping.dmp
-
memory/676-62-0x0000000000400000-0x0000000000402000-memory.dmpFilesize
8KB
-
memory/676-63-0x0000000008450000-0x00000000084E0000-memory.dmpFilesize
576KB
-
memory/676-64-0x0000000000280000-0x00000000002C3000-memory.dmpFilesize
268KB
-
memory/676-61-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/676-59-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/1240-75-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/1240-71-0x0000000000000000-mapping.dmp
-
memory/1240-78-0x00000000071D0000-0x00000000071D1000-memory.dmpFilesize
4KB
-
memory/1452-72-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1452-69-0x0000000075051000-0x0000000075053000-memory.dmpFilesize
8KB
-
memory/1452-68-0x000000000040242D-mapping.dmp
-
memory/1452-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1456-65-0x0000000000000000-mapping.dmp
-
memory/1908-81-0x0000000000000000-mapping.dmp