Analysis
-
max time kernel
84s -
max time network
133s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
12-07-2021 16:06
Static task
static1
Behavioral task
behavioral1
Sample
P_Order.scr
Resource
win7v20210410
General
-
Target
P_Order.scr
-
Size
950KB
-
MD5
b26006b1b87f94cae399ace4ed2881a5
-
SHA1
6326aa07419cec008653284ca9aabe158edb9ce7
-
SHA256
a163607a059886c8fb885f9054c9afa3103c25cca976ea7ac082e1baf02fcd7c
-
SHA512
ae92c14038ecb323b97e70e4474881fdb804262dee8f63c8e6c353560d4c8ca3ae69ca3d2dcdd3122171e2223f5e49a56d3621695fb9dd6762da733e47a8c685
Malware Config
Extracted
netwire
harold.ns01.info:3606
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
false
-
host_id
Ojoko
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
enbSUNvD
-
offline_keylogger
true
-
password
master12
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/576-67-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/576-68-0x000000000040242D-mapping.dmp netwire behavioral1/memory/576-77-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1088-84-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1088-87-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 972 Host.exe 1088 Host.exe -
Loads dropped DLL 1 IoCs
Processes:
P_Order.scrpid process 576 P_Order.scr -
Suspicious use of SetThreadContext 2 IoCs
Processes:
P_Order.scrHost.exedescription pid process target process PID 1852 set thread context of 576 1852 P_Order.scr P_Order.scr PID 972 set thread context of 1088 972 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1520 schtasks.exe 1760 schtasks.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
P_Order.scrP_Order.scrHost.exedescription pid process target process PID 1852 wrote to memory of 1760 1852 P_Order.scr schtasks.exe PID 1852 wrote to memory of 1760 1852 P_Order.scr schtasks.exe PID 1852 wrote to memory of 1760 1852 P_Order.scr schtasks.exe PID 1852 wrote to memory of 1760 1852 P_Order.scr schtasks.exe PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 1852 wrote to memory of 576 1852 P_Order.scr P_Order.scr PID 576 wrote to memory of 972 576 P_Order.scr Host.exe PID 576 wrote to memory of 972 576 P_Order.scr Host.exe PID 576 wrote to memory of 972 576 P_Order.scr Host.exe PID 576 wrote to memory of 972 576 P_Order.scr Host.exe PID 972 wrote to memory of 1520 972 Host.exe schtasks.exe PID 972 wrote to memory of 1520 972 Host.exe schtasks.exe PID 972 wrote to memory of 1520 972 Host.exe schtasks.exe PID 972 wrote to memory of 1520 972 Host.exe schtasks.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe PID 972 wrote to memory of 1088 972 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\P_Order.scr"C:\Users\Admin\AppData\Local\Temp\P_Order.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DqhNCJcG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp426.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\P_Order.scr"{path}"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DqhNCJcG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84BA.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp426.tmpMD5
babb5cc3c10c8468f341ef7941026b6b
SHA1167dfc8caa267de4ce7da0bbb86d204a914faa4f
SHA25695fcdcc20af9fedca933b8eb789e7b3adfee73352493de54c585c4310cc91d9e
SHA5128acc81ee6615968c3d3658a946d8d9290e1a014bfff368276083f403f47bbf96b4b7cdf16023b80a509186269a612066fac6314a1afac22be3197e5de2de5df3
-
C:\Users\Admin\AppData\Local\Temp\tmp84BA.tmpMD5
babb5cc3c10c8468f341ef7941026b6b
SHA1167dfc8caa267de4ce7da0bbb86d204a914faa4f
SHA25695fcdcc20af9fedca933b8eb789e7b3adfee73352493de54c585c4310cc91d9e
SHA5128acc81ee6615968c3d3658a946d8d9290e1a014bfff368276083f403f47bbf96b4b7cdf16023b80a509186269a612066fac6314a1afac22be3197e5de2de5df3
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
b26006b1b87f94cae399ace4ed2881a5
SHA16326aa07419cec008653284ca9aabe158edb9ce7
SHA256a163607a059886c8fb885f9054c9afa3103c25cca976ea7ac082e1baf02fcd7c
SHA512ae92c14038ecb323b97e70e4474881fdb804262dee8f63c8e6c353560d4c8ca3ae69ca3d2dcdd3122171e2223f5e49a56d3621695fb9dd6762da733e47a8c685
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
b26006b1b87f94cae399ace4ed2881a5
SHA16326aa07419cec008653284ca9aabe158edb9ce7
SHA256a163607a059886c8fb885f9054c9afa3103c25cca976ea7ac082e1baf02fcd7c
SHA512ae92c14038ecb323b97e70e4474881fdb804262dee8f63c8e6c353560d4c8ca3ae69ca3d2dcdd3122171e2223f5e49a56d3621695fb9dd6762da733e47a8c685
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
b26006b1b87f94cae399ace4ed2881a5
SHA16326aa07419cec008653284ca9aabe158edb9ce7
SHA256a163607a059886c8fb885f9054c9afa3103c25cca976ea7ac082e1baf02fcd7c
SHA512ae92c14038ecb323b97e70e4474881fdb804262dee8f63c8e6c353560d4c8ca3ae69ca3d2dcdd3122171e2223f5e49a56d3621695fb9dd6762da733e47a8c685
-
\Users\Admin\AppData\Roaming\Install\Host.exeMD5
b26006b1b87f94cae399ace4ed2881a5
SHA16326aa07419cec008653284ca9aabe158edb9ce7
SHA256a163607a059886c8fb885f9054c9afa3103c25cca976ea7ac082e1baf02fcd7c
SHA512ae92c14038ecb323b97e70e4474881fdb804262dee8f63c8e6c353560d4c8ca3ae69ca3d2dcdd3122171e2223f5e49a56d3621695fb9dd6762da733e47a8c685
-
memory/576-77-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/576-68-0x000000000040242D-mapping.dmp
-
memory/576-69-0x0000000074F31000-0x0000000074F33000-memory.dmpFilesize
8KB
-
memory/576-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/972-78-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/972-71-0x0000000000000000-mapping.dmp
-
memory/972-74-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/1088-87-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1088-84-0x000000000040242D-mapping.dmp
-
memory/1520-81-0x0000000000000000-mapping.dmp
-
memory/1760-65-0x0000000000000000-mapping.dmp
-
memory/1852-59-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1852-62-0x0000000000650000-0x0000000000652000-memory.dmpFilesize
8KB
-
memory/1852-63-0x0000000007C90000-0x0000000007D3D000-memory.dmpFilesize
692KB
-
memory/1852-61-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/1852-64-0x0000000005A40000-0x0000000005AA9000-memory.dmpFilesize
420KB