Analysis
- max time kernel
179s - max time network
204s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/02/2022, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe
- Size 716KB
- Sample220209-mc56ysabcp
- SHA256 23d09e266528b3ffbd4fc656743303461b9c8a5780d02e28b666243406915401
- MD5 3e160f9c8b0f124888f022b628ac6f7e
- SHA1 38349b9299c8a94caad8e2d7f187d5e00cee1abd
- SHA512 04c0249212f2fe05c68a09a3e85c52aee03ab929ac6b41ec628a1626fa5af66b5ae6d02f80e9af5b0d77a8553d9676fe2c8e51c5a33b49776e3b3eefe3520bea
- MD5 SHA1 SHA512
Malware Config
Signatures
- NetWire RAT payload 2 IoCs
resource yara_rule behavioral2/memory/4688-140-0x00000000725C0000-0x00000000725F5000-memory.dmp netwire behavioral2/memory/4688-141-0x0000000000400000-0x0000000000433000-memory.dmp netwire - Executes dropped EXE 1 IoCs
pid Process 4568 ComputerDefaults.exe - Loads dropped DLL 1 IoCs
pid Process 4568 ComputerDefaults.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mtxymgiuva = "C:\\Users\\Admin\\Contacts\\avuigmyxtM.url" Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\logagent.exe logagent.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 764 PING.EXE - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1092 powershell.exe 1092 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3488 svchost.exe Token: SeCreatePagefilePrivilege 3488 svchost.exe Token: SeShutdownPrivilege 3488 svchost.exe Token: SeCreatePagefilePrivilege 3488 svchost.exe Token: SeShutdownPrivilege 3488 svchost.exe Token: SeCreatePagefilePrivilege 3488 svchost.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe Token: SeRestorePrivilege 3348 TiWorker.exe Token: SeSecurityPrivilege 3348 TiWorker.exe Token: SeBackupPrivilege 3348 TiWorker.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4688 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 98 PID 1488 wrote to memory of 4992 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 99 PID 1488 wrote to memory of 4992 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 99 PID 1488 wrote to memory of 4992 1488 Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe 99 PID 4992 wrote to memory of 4948 4992 cmd.exe 101 PID 4992 wrote to memory of 4948 4992 cmd.exe 101 PID 4992 wrote to memory of 4948 4992 cmd.exe 101 PID 4948 wrote to memory of 4568 4948 cmd.exe 103 PID 4948 wrote to memory of 4568 4948 cmd.exe 103 PID 4568 wrote to memory of 4296 4568 ComputerDefaults.exe 104 PID 4568 wrote to memory of 4296 4568 ComputerDefaults.exe 104 PID 4948 wrote to memory of 764 4948 cmd.exe 106 PID 4948 wrote to memory of 764 4948 cmd.exe 106 PID 4948 wrote to memory of 764 4948 cmd.exe 106 PID 4296 wrote to memory of 1092 4296 cmd.exe 107 PID 4296 wrote to memory of 1092 4296 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe"C:\Users\Admin\AppData\Local\Temp\Mtxymgiuvaqhsnvczideuhnykrfdxiosoz.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
- Drops file in System32 directory
PID:4688
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Contacts\Mtxymgiuvat.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\Contacts\MtxymgiuvaO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows \System32\ComputerDefaults.exe"C:\Windows \System32\ComputerDefaults.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""5⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"6⤵
- Suspicious behavior: EnumeratesProcesses
PID:1092
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 64⤵
- Runs ping.exe
PID:764
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3348