Analysis
-
max time kernel
105s -
max time network
159s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-07-2021 06:04
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7v20210408
General
-
Target
Order.exe
-
Size
853KB
-
MD5
103362e59d9fd456e9ce47da23e14e4f
-
SHA1
5f557d79f1085f1e05da881204d341f2c82b20b9
-
SHA256
f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40
-
SHA512
b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e
Malware Config
Extracted
netwire
37.120.234.120:19792
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
FvEKqKqS
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1540-126-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1540-127-0x000000000040242D-mapping.dmp netwire behavioral2/memory/1540-128-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2276-139-0x00000000056F0000-0x0000000005BEE000-memory.dmp netwire behavioral2/memory/3880-145-0x000000000040242D-mapping.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 2276 Host.exe 3880 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Order.exeHost.exedescription pid process target process PID 992 set thread context of 1540 992 Order.exe Order.exe PID 2276 set thread context of 3880 2276 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1380 schtasks.exe 2304 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Order.exeHost.exepid process 992 Order.exe 2276 Host.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order.exeHost.exedescription pid process Token: SeDebugPrivilege 992 Order.exe Token: SeDebugPrivilege 2276 Host.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
Order.exeOrder.exeHost.exedescription pid process target process PID 992 wrote to memory of 1380 992 Order.exe schtasks.exe PID 992 wrote to memory of 1380 992 Order.exe schtasks.exe PID 992 wrote to memory of 1380 992 Order.exe schtasks.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 992 wrote to memory of 1540 992 Order.exe Order.exe PID 1540 wrote to memory of 2276 1540 Order.exe Host.exe PID 1540 wrote to memory of 2276 1540 Order.exe Host.exe PID 1540 wrote to memory of 2276 1540 Order.exe Host.exe PID 2276 wrote to memory of 2304 2276 Host.exe schtasks.exe PID 2276 wrote to memory of 2304 2276 Host.exe schtasks.exe PID 2276 wrote to memory of 2304 2276 Host.exe schtasks.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe PID 2276 wrote to memory of 3880 2276 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vabtzuyh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp58CF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vabtzuyh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1A4A.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1A4A.tmpMD5
d56ec2d86d030b1848c5dc2c46582fe1
SHA14085bbe2596a8f6d93f5f0f724b06661c198d8a6
SHA256216b2bf04f71da8d00ebb1e091be5bdcf35f1548f5f58eab432c677654499e0b
SHA5125965e994fbe0622e5d7771e9b4b1aa1e19b4184b5047deed1d22b4f415c5f6052fd057012ffa111875f6a1707fbb391db9c98348652c9dac0c9d8916c4f79aba
-
C:\Users\Admin\AppData\Local\Temp\tmp58CF.tmpMD5
d56ec2d86d030b1848c5dc2c46582fe1
SHA14085bbe2596a8f6d93f5f0f724b06661c198d8a6
SHA256216b2bf04f71da8d00ebb1e091be5bdcf35f1548f5f58eab432c677654499e0b
SHA5125965e994fbe0622e5d7771e9b4b1aa1e19b4184b5047deed1d22b4f415c5f6052fd057012ffa111875f6a1707fbb391db9c98348652c9dac0c9d8916c4f79aba
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
103362e59d9fd456e9ce47da23e14e4f
SHA15f557d79f1085f1e05da881204d341f2c82b20b9
SHA256f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40
SHA512b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
103362e59d9fd456e9ce47da23e14e4f
SHA15f557d79f1085f1e05da881204d341f2c82b20b9
SHA256f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40
SHA512b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
103362e59d9fd456e9ce47da23e14e4f
SHA15f557d79f1085f1e05da881204d341f2c82b20b9
SHA256f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40
SHA512b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e
-
memory/992-114-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/992-116-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/992-122-0x0000000006580000-0x0000000006637000-memory.dmpFilesize
732KB
-
memory/992-123-0x000000000A970000-0x000000000A9DB000-memory.dmpFilesize
428KB
-
memory/992-117-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/992-121-0x0000000007EE0000-0x0000000007EE1000-memory.dmpFilesize
4KB
-
memory/992-118-0x0000000004970000-0x0000000004E6E000-memory.dmpFilesize
5.0MB
-
memory/992-120-0x0000000004DD0000-0x0000000004DD2000-memory.dmpFilesize
8KB
-
memory/992-119-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/1380-124-0x0000000000000000-mapping.dmp
-
memory/1540-126-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1540-127-0x000000000040242D-mapping.dmp
-
memory/1540-128-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2276-129-0x0000000000000000-mapping.dmp
-
memory/2276-139-0x00000000056F0000-0x0000000005BEE000-memory.dmpFilesize
5.0MB
-
memory/2304-142-0x0000000000000000-mapping.dmp
-
memory/3880-145-0x000000000040242D-mapping.dmp