Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-04-2022 01:06
Static task
static1
Behavioral task
behavioral1
Sample
000040021.exe
Resource
win7-20220414-en
General
-
Target
000040021.exe
-
Size
179KB
-
MD5
6f6f64b82c949798ec80ecddea570ba9
-
SHA1
9895fe43bf8b037ec9110294e681410f419cf64b
-
SHA256
5978ce4905969580753f948beb8265a13d133cf29f9ddb206475a7f06f8fc885
-
SHA512
263308644df6dfc89d2466646ec7fda1092150128af96b8c62050c1b30f8ee0f8b0fa4ed03a375f2c78e5f5926e7b043db65b9a8b484b1d5a88760bb628e6cc6
Malware Config
Extracted
formbook
4.1
oh75
denizgidam.com
6cc06.com
charlottewaldburgzeil.com
medijanus.com
qingdaoyiersan.com
datcabilgisayar.xyz
111439d.com
xn--1ruo40k.com
wu6enxwcx5h3.xyz
vnscloud.net
brtka.xyz
showztime.com
promocoesdedezenbro.com
wokpy.com
chnowuk.online
rockshotscafe.com
pelrjy.com
nato-riness.com
feixiang-chem.com
thcoinexchange.com
fuelrescuereponse.com
digitaltunic.com
cellefill.com
paulbau.com
camillebeckman.xyz
ilico-media.com
603sa.com
firstechfedcu.com
koreaglp.com
thebeardedbrocksblends.com
musumeya-kotora.com
tocoteacanada.com
travelwitharden.com
diversamenteclinica.com
bw613.com
qe46.com
spectrumelectrolysis.com
maloyenterprises.com
inovasyon.xyz
remijoe.com
petsgallie.com
metagiphydownload.online
tigerdieect.com
jamedomp.com
peninsularbottling.com
1383fx.com
pandeymasala.online
spoilnet.com
itweu.com
ankxbi.icu
lm-safe-keepingyuchand92.xyz
dreamdsjoceo.com
providentview.com
newchinafortpayne.com
wu6bvnrlz4ra.xyz
intrasvp.com
ghoul-ambrose.com
alltenexpress.com
oniray.com
sistemaparadrogaria.com
zeidrei514-nifty.xyz
excaliburteacher.com
jennyandsteven.com
zakcotransportationllc.com
wwwccsuresults.com
Extracted
netwire
127.0.0.1:3360
212.192.246.209:141
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
04-22
- install_path
- keylogger_dir
-
lock_executable
false
- mutex
-
offline_keylogger
false
-
password
123456
-
registry_autorun
false
-
startup_name
�k
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4240-159-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral2/memory/4240-161-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral2/memory/4240-162-0x0000000000400000-0x0000000000444000-memory.dmp netwire -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2556-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2556-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2720-151-0x00000000007F0000-0x000000000081F000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
Kyxlubuhi.exepid process 1920 Kyxlubuhi.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
000040021.exeKyxlubuhi.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 000040021.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Kyxlubuhi.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
InstallUtil.exe000040021.exeKyxlubuhi.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ InstallUtil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\‚k = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe" InstallUtil.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aoev = "\"C:\\Users\\Admin\\AppData\\Roaming\\Nakgjel\\Aoev.exe\"" 000040021.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aoev = "\"C:\\Users\\Admin\\AppData\\Roaming\\Nakgjel\\Aoev.exe\"" Kyxlubuhi.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
000040021.exeInstallUtil.exeWWAHost.exeKyxlubuhi.exedescription pid process target process PID 372 set thread context of 2556 372 000040021.exe InstallUtil.exe PID 2556 set thread context of 3148 2556 InstallUtil.exe Explorer.EXE PID 2720 set thread context of 3148 2720 WWAHost.exe Explorer.EXE PID 1920 set thread context of 4240 1920 Kyxlubuhi.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1996 timeout.exe 4408 timeout.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
000040021.exeInstallUtil.exeWWAHost.exeKyxlubuhi.exepid process 372 000040021.exe 372 000040021.exe 372 000040021.exe 372 000040021.exe 372 000040021.exe 372 000040021.exe 2556 InstallUtil.exe 2556 InstallUtil.exe 2556 InstallUtil.exe 2556 InstallUtil.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 1920 Kyxlubuhi.exe 1920 Kyxlubuhi.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe 2720 WWAHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3148 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.exeWWAHost.exepid process 2556 InstallUtil.exe 2556 InstallUtil.exe 2556 InstallUtil.exe 2720 WWAHost.exe 2720 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
000040021.exeInstallUtil.exeWWAHost.exeKyxlubuhi.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 372 000040021.exe Token: SeDebugPrivilege 2556 InstallUtil.exe Token: SeDebugPrivilege 2720 WWAHost.exe Token: SeDebugPrivilege 1920 Kyxlubuhi.exe Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
000040021.execmd.exeExplorer.EXEWWAHost.exeKyxlubuhi.execmd.exedescription pid process target process PID 372 wrote to memory of 976 372 000040021.exe cmd.exe PID 372 wrote to memory of 976 372 000040021.exe cmd.exe PID 372 wrote to memory of 976 372 000040021.exe cmd.exe PID 976 wrote to memory of 1996 976 cmd.exe timeout.exe PID 976 wrote to memory of 1996 976 cmd.exe timeout.exe PID 976 wrote to memory of 1996 976 cmd.exe timeout.exe PID 372 wrote to memory of 1920 372 000040021.exe Kyxlubuhi.exe PID 372 wrote to memory of 1920 372 000040021.exe Kyxlubuhi.exe PID 372 wrote to memory of 1920 372 000040021.exe Kyxlubuhi.exe PID 372 wrote to memory of 2416 372 000040021.exe InstallUtil.exe PID 372 wrote to memory of 2416 372 000040021.exe InstallUtil.exe PID 372 wrote to memory of 2416 372 000040021.exe InstallUtil.exe PID 372 wrote to memory of 2556 372 000040021.exe InstallUtil.exe PID 372 wrote to memory of 2556 372 000040021.exe InstallUtil.exe PID 372 wrote to memory of 2556 372 000040021.exe InstallUtil.exe PID 372 wrote to memory of 2556 372 000040021.exe InstallUtil.exe PID 372 wrote to memory of 2556 372 000040021.exe InstallUtil.exe PID 372 wrote to memory of 2556 372 000040021.exe InstallUtil.exe PID 3148 wrote to memory of 2720 3148 Explorer.EXE WWAHost.exe PID 3148 wrote to memory of 2720 3148 Explorer.EXE WWAHost.exe PID 3148 wrote to memory of 2720 3148 Explorer.EXE WWAHost.exe PID 2720 wrote to memory of 5036 2720 WWAHost.exe cmd.exe PID 2720 wrote to memory of 5036 2720 WWAHost.exe cmd.exe PID 2720 wrote to memory of 5036 2720 WWAHost.exe cmd.exe PID 1920 wrote to memory of 3488 1920 Kyxlubuhi.exe cmd.exe PID 1920 wrote to memory of 3488 1920 Kyxlubuhi.exe cmd.exe PID 1920 wrote to memory of 3488 1920 Kyxlubuhi.exe cmd.exe PID 3488 wrote to memory of 4408 3488 cmd.exe timeout.exe PID 3488 wrote to memory of 4408 3488 cmd.exe timeout.exe PID 3488 wrote to memory of 4408 3488 cmd.exe timeout.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe PID 1920 wrote to memory of 4240 1920 Kyxlubuhi.exe InstallUtil.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\000040021.exe"C:\Users\Admin\AppData\Local\Temp\000040021.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exe"C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 104⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 105⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe4⤵
- Adds Run key to start application
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exeFilesize
179KB
MD512c5bc1a739dfd4e5a54c0a1b47daff6
SHA1e4d994d9a61824ada303d54448d2d384484a961c
SHA2563ccf4ad2172cb3a4e39fbdb1692673d3d4e06541dff20bc896e033f2caeac28a
SHA512e58795819fe73952529cee7f18a80bbfd0575d15b71b1a07e79e6832faf477653b718d70e881db43933876aaa58d723ad2f57479ce1dd327979a43185f9859dc
-
C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exeFilesize
179KB
MD512c5bc1a739dfd4e5a54c0a1b47daff6
SHA1e4d994d9a61824ada303d54448d2d384484a961c
SHA2563ccf4ad2172cb3a4e39fbdb1692673d3d4e06541dff20bc896e033f2caeac28a
SHA512e58795819fe73952529cee7f18a80bbfd0575d15b71b1a07e79e6832faf477653b718d70e881db43933876aaa58d723ad2f57479ce1dd327979a43185f9859dc
-
C:\Users\Admin\AppData\Roaming\Nakgjel\Aoev.exeFilesize
179KB
MD512c5bc1a739dfd4e5a54c0a1b47daff6
SHA1e4d994d9a61824ada303d54448d2d384484a961c
SHA2563ccf4ad2172cb3a4e39fbdb1692673d3d4e06541dff20bc896e033f2caeac28a
SHA512e58795819fe73952529cee7f18a80bbfd0575d15b71b1a07e79e6832faf477653b718d70e881db43933876aaa58d723ad2f57479ce1dd327979a43185f9859dc
-
memory/372-130-0x0000000000F60000-0x0000000000F92000-memory.dmpFilesize
200KB
-
memory/372-131-0x0000000005F90000-0x0000000006534000-memory.dmpFilesize
5.6MB
-
memory/372-132-0x0000000005930000-0x00000000059C2000-memory.dmpFilesize
584KB
-
memory/372-133-0x00000000059F0000-0x00000000059FA000-memory.dmpFilesize
40KB
-
memory/976-134-0x0000000000000000-mapping.dmp
-
memory/1920-136-0x0000000000000000-mapping.dmp
-
memory/1920-139-0x00000000003F0000-0x0000000000422000-memory.dmpFilesize
200KB
-
memory/1996-135-0x0000000000000000-mapping.dmp
-
memory/2416-140-0x0000000000000000-mapping.dmp
-
memory/2556-145-0x0000000001450000-0x000000000179A000-memory.dmpFilesize
3.3MB
-
memory/2556-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2556-141-0x0000000000000000-mapping.dmp
-
memory/2556-146-0x0000000001300000-0x0000000001314000-memory.dmpFilesize
80KB
-
memory/2556-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2720-152-0x0000000001B70000-0x0000000001EBA000-memory.dmpFilesize
3.3MB
-
memory/2720-150-0x0000000000940000-0x0000000000A1C000-memory.dmpFilesize
880KB
-
memory/2720-151-0x00000000007F0000-0x000000000081F000-memory.dmpFilesize
188KB
-
memory/2720-148-0x0000000000000000-mapping.dmp
-
memory/2720-153-0x00000000010A0000-0x0000000001133000-memory.dmpFilesize
588KB
-
memory/3148-147-0x0000000002720000-0x00000000027E1000-memory.dmpFilesize
772KB
-
memory/3148-154-0x0000000002B70000-0x0000000002CF0000-memory.dmpFilesize
1.5MB
-
memory/3488-155-0x0000000000000000-mapping.dmp
-
memory/4240-158-0x0000000000000000-mapping.dmp
-
memory/4240-159-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4240-161-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4240-162-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4408-156-0x0000000000000000-mapping.dmp
-
memory/5036-149-0x0000000000000000-mapping.dmp