Overview

overview

10

Static

static

detail-informa...on.exe

windows7_x64

10

detail-informa...on.exe

windows10-2004_x64

10
General
Target

detail-information.exe

Filesize

494KB

Completed

21-05-2022 01:09

Task

behavioral1

Score
10/10
MD5

07591af2349f8ebc5789fcb0b60c7c91

SHA1

828bcdd3d1e32d2ed0b0660fc92f41a562d4d466

SHA256

b50a0ea3d467e25e9c1917668e10f70e67434e468fcecbb1d3a927a3f105dbfa

SHA512

8bc1068c0d85f62176fe8e23ec23ecbcfaa1296d379c26ff5fe7ee274c5ef7d12b7a1fec44941eca9841af17c61c5c1b3ad50739fb5d5baadd72bf2feef48ad3

Malware Config
Signatures 9

Filter: none

Discovery
  • NetWire RAT payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/2012-63-0x0000000000400000-0x0000000000433000-memory.dmpnetwire
    behavioral1/memory/1176-70-0x0000000000400000-0x0000000000433000-memory.dmpnetwire
  • Netwire

    Description

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    Tags

  • Drops startup file
    detail-information.exedetail-information.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exedetail-information.exe
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exedetail-information.exe
  • Suspicious use of SetThreadContext
    detail-information.exedetail-information.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1016 set thread context of 20121016detail-information.exeRegAsm.exe
    PID 1688 set thread context of 11761688detail-information.exeRegAsm.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: EnumeratesProcesses
    detail-information.exedetail-information.exe

    Reported IOCs

    pidprocess
    1016detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
    1688detail-information.exe
    1016detail-information.exe
    1016detail-information.exe
    1688detail-information.exe
  • Suspicious behavior: MapViewOfSection
    detail-information.exedetail-information.exe

    Reported IOCs

    pidprocess
    1016detail-information.exe
    1688detail-information.exe
  • Suspicious use of AdjustPrivilegeToken
    detail-information.exedetail-information.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1016detail-information.exe
    Token: SeDebugPrivilege1688detail-information.exe
  • Suspicious use of WriteProcessMemory
    detail-information.execmd.exedetail-information.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1016 wrote to memory of 20121016detail-information.exeRegAsm.exe
    PID 1016 wrote to memory of 20121016detail-information.exeRegAsm.exe
    PID 1016 wrote to memory of 20121016detail-information.exeRegAsm.exe
    PID 1016 wrote to memory of 20121016detail-information.exeRegAsm.exe
    PID 1016 wrote to memory of 20121016detail-information.exeRegAsm.exe
    PID 1016 wrote to memory of 20121016detail-information.exeRegAsm.exe
    PID 1016 wrote to memory of 20121016detail-information.exeRegAsm.exe
    PID 1016 wrote to memory of 20121016detail-information.exeRegAsm.exe
    PID 1016 wrote to memory of 10361016detail-information.execmd.exe
    PID 1016 wrote to memory of 10361016detail-information.execmd.exe
    PID 1016 wrote to memory of 10361016detail-information.execmd.exe
    PID 1016 wrote to memory of 10361016detail-information.execmd.exe
    PID 1036 wrote to memory of 9641036cmd.exechoice.exe
    PID 1036 wrote to memory of 9641036cmd.exechoice.exe
    PID 1036 wrote to memory of 9641036cmd.exechoice.exe
    PID 1036 wrote to memory of 9641036cmd.exechoice.exe
    PID 1016 wrote to memory of 16881016detail-information.exedetail-information.exe
    PID 1016 wrote to memory of 16881016detail-information.exedetail-information.exe
    PID 1016 wrote to memory of 16881016detail-information.exedetail-information.exe
    PID 1016 wrote to memory of 16881016detail-information.exedetail-information.exe
    PID 1688 wrote to memory of 11761688detail-information.exeRegAsm.exe
    PID 1688 wrote to memory of 11761688detail-information.exeRegAsm.exe
    PID 1688 wrote to memory of 11761688detail-information.exeRegAsm.exe
    PID 1688 wrote to memory of 11761688detail-information.exeRegAsm.exe
    PID 1688 wrote to memory of 11761688detail-information.exeRegAsm.exe
    PID 1688 wrote to memory of 11761688detail-information.exeRegAsm.exe
    PID 1688 wrote to memory of 11761688detail-information.exeRegAsm.exe
    PID 1688 wrote to memory of 11761688detail-information.exeRegAsm.exe
    PID 1688 wrote to memory of 10321688detail-information.execmd.exe
    PID 1688 wrote to memory of 10321688detail-information.execmd.exe
    PID 1688 wrote to memory of 10321688detail-information.execmd.exe
    PID 1688 wrote to memory of 10321688detail-information.execmd.exe
    PID 1032 wrote to memory of 13921032cmd.exechoice.exe
    PID 1032 wrote to memory of 13921032cmd.exechoice.exe
    PID 1032 wrote to memory of 13921032cmd.exechoice.exe
    PID 1032 wrote to memory of 13921032cmd.exechoice.exe
Processes 8
  • C:\Users\Admin\AppData\Local\Temp\detail-information.exe
    "C:\Users\Admin\AppData\Local\Temp\detail-information.exe"
    Drops startup file
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: MapViewOfSection
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      PID:2012
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\detail-information.exe"
      Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Windows\SysWOW64\choice.exe
        choice /C Y /N /D Y /T 3
        PID:964
    • C:\Users\Admin\AppData\Local\Temp\detail-information.exe
      "C:\Users\Admin\AppData\Local\Temp\detail-information.exe"
      Drops startup file
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        PID:1176
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\detail-information.exe"
        Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Windows\SysWOW64\choice.exe
          choice /C Y /N /D Y /T 3
          PID:1392
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads

                        • memory/964-61-0x0000000000000000-mapping.dmp

                          Download

                        • memory/1016-55-0x0000000004250000-0x0000000004286000-memory.dmp

                          Download

                        • memory/1016-56-0x0000000000440000-0x0000000000443000-memory.dmp

                          Download

                        • memory/1016-57-0x0000000075F61000-0x0000000075F63000-memory.dmp

                          Download

                        • memory/1016-62-0x00000000008C0000-0x00000000008C3000-memory.dmp

                          Download

                        • memory/1016-54-0x0000000000220000-0x00000000002A2000-memory.dmp

                          Download

                        • memory/1032-68-0x0000000000000000-mapping.dmp

                          Download

                        • memory/1036-60-0x0000000000000000-mapping.dmp

                          Download

                        • memory/1176-70-0x0000000000400000-0x0000000000433000-memory.dmp

                          Download

                        • memory/1176-66-0x000000000040242D-mapping.dmp

                          Download

                        • memory/1392-69-0x0000000000000000-mapping.dmp

                          Download

                        • memory/1688-64-0x0000000000000000-mapping.dmp

                          Download

                        • memory/2012-58-0x000000000040242D-mapping.dmp

                          Download

                        • memory/2012-63-0x0000000000400000-0x0000000000433000-memory.dmp

                          Download