Analysis
-
max time kernel
99s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-07-2021 06:03
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7v20210410
General
-
Target
Order.exe
-
Size
853KB
-
MD5
103362e59d9fd456e9ce47da23e14e4f
-
SHA1
5f557d79f1085f1e05da881204d341f2c82b20b9
-
SHA256
f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40
-
SHA512
b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e
Malware Config
Extracted
netwire
37.120.234.120:19792
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
FvEKqKqS
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3116-126-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3116-127-0x000000000040242D-mapping.dmp netwire behavioral2/memory/2116-137-0x0000000004C00000-0x00000000050FE000-memory.dmp netwire behavioral2/memory/3116-136-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2772-146-0x000000000040242D-mapping.dmp netwire -
Executes dropped EXE 3 IoCs
Processes:
Host.exeHost.exeHost.exepid process 2116 Host.exe 2740 Host.exe 2772 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Order.exeHost.exedescription pid process target process PID 2232 set thread context of 3116 2232 Order.exe Order.exe PID 2116 set thread context of 2772 2116 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3396 schtasks.exe 3932 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Order.exeHost.exepid process 2232 Order.exe 2232 Order.exe 2232 Order.exe 2232 Order.exe 2232 Order.exe 2232 Order.exe 2232 Order.exe 2116 Host.exe 2116 Host.exe 2116 Host.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order.exeHost.exedescription pid process Token: SeDebugPrivilege 2232 Order.exe Token: SeDebugPrivilege 2116 Host.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
Order.exeOrder.exeHost.exedescription pid process target process PID 2232 wrote to memory of 3396 2232 Order.exe schtasks.exe PID 2232 wrote to memory of 3396 2232 Order.exe schtasks.exe PID 2232 wrote to memory of 3396 2232 Order.exe schtasks.exe PID 2232 wrote to memory of 1144 2232 Order.exe Order.exe PID 2232 wrote to memory of 1144 2232 Order.exe Order.exe PID 2232 wrote to memory of 1144 2232 Order.exe Order.exe PID 2232 wrote to memory of 1348 2232 Order.exe Order.exe PID 2232 wrote to memory of 1348 2232 Order.exe Order.exe PID 2232 wrote to memory of 1348 2232 Order.exe Order.exe PID 2232 wrote to memory of 1140 2232 Order.exe Order.exe PID 2232 wrote to memory of 1140 2232 Order.exe Order.exe PID 2232 wrote to memory of 1140 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 2232 wrote to memory of 3116 2232 Order.exe Order.exe PID 3116 wrote to memory of 2116 3116 Order.exe Host.exe PID 3116 wrote to memory of 2116 3116 Order.exe Host.exe PID 3116 wrote to memory of 2116 3116 Order.exe Host.exe PID 2116 wrote to memory of 3932 2116 Host.exe schtasks.exe PID 2116 wrote to memory of 3932 2116 Host.exe schtasks.exe PID 2116 wrote to memory of 3932 2116 Host.exe schtasks.exe PID 2116 wrote to memory of 2740 2116 Host.exe Host.exe PID 2116 wrote to memory of 2740 2116 Host.exe Host.exe PID 2116 wrote to memory of 2740 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe PID 2116 wrote to memory of 2772 2116 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vabtzuyh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE082.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vabtzuyh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D79.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9D79.tmpMD5
67180dc7300556e57f7896c0706b426b
SHA195291f6b8b7e7b0658259e304111847b4b355344
SHA256b4909a6679d9ead1ac51fbc7fff2ac8fef67eaf31057091645c08fdd51cff596
SHA5126b70ad1f2d8b270ce1a85c948b05b9fa73351c7ed260b374a8aa82e9ba77f8d729f4470c1c91c648756e351f2c9d0afff84e66ac8f063f6f09d4a648f3dfcfa9
-
C:\Users\Admin\AppData\Local\Temp\tmpE082.tmpMD5
67180dc7300556e57f7896c0706b426b
SHA195291f6b8b7e7b0658259e304111847b4b355344
SHA256b4909a6679d9ead1ac51fbc7fff2ac8fef67eaf31057091645c08fdd51cff596
SHA5126b70ad1f2d8b270ce1a85c948b05b9fa73351c7ed260b374a8aa82e9ba77f8d729f4470c1c91c648756e351f2c9d0afff84e66ac8f063f6f09d4a648f3dfcfa9
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
103362e59d9fd456e9ce47da23e14e4f
SHA15f557d79f1085f1e05da881204d341f2c82b20b9
SHA256f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40
SHA512b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
103362e59d9fd456e9ce47da23e14e4f
SHA15f557d79f1085f1e05da881204d341f2c82b20b9
SHA256f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40
SHA512b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
103362e59d9fd456e9ce47da23e14e4f
SHA15f557d79f1085f1e05da881204d341f2c82b20b9
SHA256f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40
SHA512b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
103362e59d9fd456e9ce47da23e14e4f
SHA15f557d79f1085f1e05da881204d341f2c82b20b9
SHA256f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40
SHA512b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e
-
memory/2116-128-0x0000000000000000-mapping.dmp
-
memory/2116-137-0x0000000004C00000-0x00000000050FE000-memory.dmpFilesize
5.0MB
-
memory/2232-123-0x0000000008BD0000-0x0000000008C3B000-memory.dmpFilesize
428KB
-
memory/2232-116-0x0000000005A00000-0x0000000005A01000-memory.dmpFilesize
4KB
-
memory/2232-118-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/2232-120-0x00000000056A0000-0x00000000056A2000-memory.dmpFilesize
8KB
-
memory/2232-119-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/2232-117-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/2232-114-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/2232-122-0x0000000008AD0000-0x0000000008B87000-memory.dmpFilesize
732KB
-
memory/2232-121-0x0000000007500000-0x0000000007501000-memory.dmpFilesize
4KB
-
memory/2772-146-0x000000000040242D-mapping.dmp
-
memory/3116-127-0x000000000040242D-mapping.dmp
-
memory/3116-136-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3116-126-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3396-124-0x0000000000000000-mapping.dmp
-
memory/3932-142-0x0000000000000000-mapping.dmp