Analysis
-
max time kernel
94s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:43
Static task
static1
Behavioral task
behavioral1
Sample
lAKdWjhOYMA6YfG.exe
Resource
win7-20220414-en
General
-
Target
lAKdWjhOYMA6YfG.exe
-
Size
419KB
-
MD5
fd175da54494e88a5777471577927264
-
SHA1
60398520b817355b5644f4b3dfbb147638122dd2
-
SHA256
73b0fb36b1b8763ebb06328273016c4c4c65b20d2abc3b5bb0566a6f13aa086d
-
SHA512
ceb0f4aa2a962f5e5da4a7d5f1f50ebfb59918eb1ecaded728ae0266f1ae03e37a44f3e9dc06d1ebd5c46fc4bd1098191d5598090b3769a64ec8e369019ae7c3
Malware Config
Extracted
netwire
sepp.myq-see.com:2001
-
activex_autorun
true
-
activex_key
{50L4QLIK-5N0E-1U7P-5W65-RDN0R6N72FF0}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
XdWObmml
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/5004-138-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/5004-140-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/5004-141-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4080-151-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4080-152-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 5060 Host.exe 4080 Host.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Modifies Installed Components in the registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
lAKdWjhOYMA6YfG.exeHost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion lAKdWjhOYMA6YfG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion lAKdWjhOYMA6YfG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Host.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Host.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lAKdWjhOYMA6YfG.exeHost.exelAKdWjhOYMA6YfG.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation lAKdWjhOYMA6YfG.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Host.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation lAKdWjhOYMA6YfG.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
lAKdWjhOYMA6YfG.exeHost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 lAKdWjhOYMA6YfG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Host.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum lAKdWjhOYMA6YfG.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
lAKdWjhOYMA6YfG.exeHost.exedescription pid process target process PID 1200 set thread context of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 5060 set thread context of 4080 5060 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
lAKdWjhOYMA6YfG.exeHost.exepid process 1200 lAKdWjhOYMA6YfG.exe 1200 lAKdWjhOYMA6YfG.exe 1200 lAKdWjhOYMA6YfG.exe 1200 lAKdWjhOYMA6YfG.exe 5060 Host.exe 5060 Host.exe 5060 Host.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
lAKdWjhOYMA6YfG.exeHost.exedescription pid process Token: SeDebugPrivilege 1200 lAKdWjhOYMA6YfG.exe Token: SeDebugPrivilege 5060 Host.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
lAKdWjhOYMA6YfG.exelAKdWjhOYMA6YfG.exeHost.exedescription pid process target process PID 1200 wrote to memory of 400 1200 lAKdWjhOYMA6YfG.exe schtasks.exe PID 1200 wrote to memory of 400 1200 lAKdWjhOYMA6YfG.exe schtasks.exe PID 1200 wrote to memory of 400 1200 lAKdWjhOYMA6YfG.exe schtasks.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 1200 wrote to memory of 5004 1200 lAKdWjhOYMA6YfG.exe lAKdWjhOYMA6YfG.exe PID 5004 wrote to memory of 5060 5004 lAKdWjhOYMA6YfG.exe Host.exe PID 5004 wrote to memory of 5060 5004 lAKdWjhOYMA6YfG.exe Host.exe PID 5004 wrote to memory of 5060 5004 lAKdWjhOYMA6YfG.exe Host.exe PID 5060 wrote to memory of 3352 5060 Host.exe schtasks.exe PID 5060 wrote to memory of 3352 5060 Host.exe schtasks.exe PID 5060 wrote to memory of 3352 5060 Host.exe schtasks.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe PID 5060 wrote to memory of 4080 5060 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lAKdWjhOYMA6YfG.exe"C:\Users\Admin\AppData\Local\Temp\lAKdWjhOYMA6YfG.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fukEDc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC1BA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\lAKdWjhOYMA6YfG.exe"{path}"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fukEDc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp66A4.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp66A4.tmpFilesize
1KB
MD54bc2ca93971cf6ba5a6c7a8166478088
SHA15b14c5b82f8cd3e83691a36ebc204339e65b3083
SHA256e9b99913c283f9b18ed786754f9e79f4a006719241f55030391e419ccd4d44b4
SHA512ed220e4d3d90e9b7ad4f13715dfae903f5fa1acb91246e4a15f1647e09e6127f4935bbf5dfbbc48b7ade4a6aa7a670af288a55fb47630f76561560da51d14e3d
-
C:\Users\Admin\AppData\Local\Temp\tmpC1BA.tmpFilesize
1KB
MD54bc2ca93971cf6ba5a6c7a8166478088
SHA15b14c5b82f8cd3e83691a36ebc204339e65b3083
SHA256e9b99913c283f9b18ed786754f9e79f4a006719241f55030391e419ccd4d44b4
SHA512ed220e4d3d90e9b7ad4f13715dfae903f5fa1acb91246e4a15f1647e09e6127f4935bbf5dfbbc48b7ade4a6aa7a670af288a55fb47630f76561560da51d14e3d
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
419KB
MD5fd175da54494e88a5777471577927264
SHA160398520b817355b5644f4b3dfbb147638122dd2
SHA25673b0fb36b1b8763ebb06328273016c4c4c65b20d2abc3b5bb0566a6f13aa086d
SHA512ceb0f4aa2a962f5e5da4a7d5f1f50ebfb59918eb1ecaded728ae0266f1ae03e37a44f3e9dc06d1ebd5c46fc4bd1098191d5598090b3769a64ec8e369019ae7c3
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
419KB
MD5fd175da54494e88a5777471577927264
SHA160398520b817355b5644f4b3dfbb147638122dd2
SHA25673b0fb36b1b8763ebb06328273016c4c4c65b20d2abc3b5bb0566a6f13aa086d
SHA512ceb0f4aa2a962f5e5da4a7d5f1f50ebfb59918eb1ecaded728ae0266f1ae03e37a44f3e9dc06d1ebd5c46fc4bd1098191d5598090b3769a64ec8e369019ae7c3
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
419KB
MD5fd175da54494e88a5777471577927264
SHA160398520b817355b5644f4b3dfbb147638122dd2
SHA25673b0fb36b1b8763ebb06328273016c4c4c65b20d2abc3b5bb0566a6f13aa086d
SHA512ceb0f4aa2a962f5e5da4a7d5f1f50ebfb59918eb1ecaded728ae0266f1ae03e37a44f3e9dc06d1ebd5c46fc4bd1098191d5598090b3769a64ec8e369019ae7c3
-
memory/400-135-0x0000000000000000-mapping.dmp
-
memory/1200-132-0x00000000059E0000-0x0000000005A72000-memory.dmpFilesize
584KB
-
memory/1200-130-0x0000000000FE0000-0x000000000104E000-memory.dmpFilesize
440KB
-
memory/1200-131-0x00000000060D0000-0x0000000006674000-memory.dmpFilesize
5.6MB
-
memory/1200-134-0x0000000006CA0000-0x0000000006D06000-memory.dmpFilesize
408KB
-
memory/1200-133-0x0000000006800000-0x000000000689C000-memory.dmpFilesize
624KB
-
memory/3352-145-0x0000000000000000-mapping.dmp
-
memory/4080-152-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4080-151-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4080-147-0x0000000000000000-mapping.dmp
-
memory/5004-140-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5004-141-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5004-138-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5004-137-0x0000000000000000-mapping.dmp
-
memory/5060-142-0x0000000000000000-mapping.dmp