Analysis
-
max time kernel
171s -
max time network
212s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
#204811.exe
Resource
win7-20220414-en
General
-
Target
#204811.exe
-
Size
287KB
-
MD5
1fb35d8aa5797fbbc4225a095c106552
-
SHA1
cb08a463884542659aa9856d2dd0dd8e5d3f31cb
-
SHA256
fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
-
SHA512
aeb871ca5da00328c3f5742bef2ccd6715f27c76f62db47118237312801f1b7b9672afa5becc67f01d50bc887f80b92cde80c7242468ddf55f5660774d7884bc
Malware Config
Extracted
netwire
ichie02.ddns.net:3360
84.38.135.207:3360
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
true
-
host_id
ICHIE007
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
AcYrNKLE
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-63-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1968-65-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1968-64-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1968-67-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1968-68-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1968-69-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1968-72-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1968-76-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/820-93-0x000000000040242D-mapping.dmp netwire behavioral1/memory/820-97-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/820-98-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1912 Host.exe 820 Host.exe -
Loads dropped DLL 1 IoCs
Processes:
#204811.exepid process 1968 #204811.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
#204811.exeHost.exedescription pid process target process PID 908 set thread context of 1968 908 #204811.exe #204811.exe PID 1912 set thread context of 820 1912 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
#204811.exe#204811.exeHost.exedescription pid process target process PID 908 wrote to memory of 1708 908 #204811.exe schtasks.exe PID 908 wrote to memory of 1708 908 #204811.exe schtasks.exe PID 908 wrote to memory of 1708 908 #204811.exe schtasks.exe PID 908 wrote to memory of 1708 908 #204811.exe schtasks.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 908 wrote to memory of 1968 908 #204811.exe #204811.exe PID 1968 wrote to memory of 1912 1968 #204811.exe Host.exe PID 1968 wrote to memory of 1912 1968 #204811.exe Host.exe PID 1968 wrote to memory of 1912 1968 #204811.exe Host.exe PID 1968 wrote to memory of 1912 1968 #204811.exe Host.exe PID 1912 wrote to memory of 848 1912 Host.exe schtasks.exe PID 1912 wrote to memory of 848 1912 Host.exe schtasks.exe PID 1912 wrote to memory of 848 1912 Host.exe schtasks.exe PID 1912 wrote to memory of 848 1912 Host.exe schtasks.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe PID 1912 wrote to memory of 820 1912 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\#204811.exe"C:\Users\Admin\AppData\Local\Temp\#204811.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PjnzCykUxYlaz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6893.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\#204811.exe"{path}"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\#204811.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PjnzCykUxYlaz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFDE0.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6893.tmpFilesize
1KB
MD550c808e8f7aa47da63144d763c69b4bb
SHA1c1c224c49e9532d83fa81f7445fa1f3afad8f1f4
SHA25653be710d267ce651df30aa2aeaa787d2f4130d759e4de34b79ee3d53fc84fbc5
SHA512a79f1b1d5d942ed25531ce2fa81a863021d0de11a4bc297c0f9f62c29a7e9c29e1406fa5d482558536ea0db5df4edee0e01fdcc2e735438c1fe28e06c7e7a5f6
-
C:\Users\Admin\AppData\Local\Temp\tmpFDE0.tmpFilesize
1KB
MD550c808e8f7aa47da63144d763c69b4bb
SHA1c1c224c49e9532d83fa81f7445fa1f3afad8f1f4
SHA25653be710d267ce651df30aa2aeaa787d2f4130d759e4de34b79ee3d53fc84fbc5
SHA512a79f1b1d5d942ed25531ce2fa81a863021d0de11a4bc297c0f9f62c29a7e9c29e1406fa5d482558536ea0db5df4edee0e01fdcc2e735438c1fe28e06c7e7a5f6
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
287KB
MD51fb35d8aa5797fbbc4225a095c106552
SHA1cb08a463884542659aa9856d2dd0dd8e5d3f31cb
SHA256fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
SHA512aeb871ca5da00328c3f5742bef2ccd6715f27c76f62db47118237312801f1b7b9672afa5becc67f01d50bc887f80b92cde80c7242468ddf55f5660774d7884bc
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
287KB
MD51fb35d8aa5797fbbc4225a095c106552
SHA1cb08a463884542659aa9856d2dd0dd8e5d3f31cb
SHA256fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
SHA512aeb871ca5da00328c3f5742bef2ccd6715f27c76f62db47118237312801f1b7b9672afa5becc67f01d50bc887f80b92cde80c7242468ddf55f5660774d7884bc
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
287KB
MD51fb35d8aa5797fbbc4225a095c106552
SHA1cb08a463884542659aa9856d2dd0dd8e5d3f31cb
SHA256fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
SHA512aeb871ca5da00328c3f5742bef2ccd6715f27c76f62db47118237312801f1b7b9672afa5becc67f01d50bc887f80b92cde80c7242468ddf55f5660774d7884bc
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
287KB
MD51fb35d8aa5797fbbc4225a095c106552
SHA1cb08a463884542659aa9856d2dd0dd8e5d3f31cb
SHA256fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
SHA512aeb871ca5da00328c3f5742bef2ccd6715f27c76f62db47118237312801f1b7b9672afa5becc67f01d50bc887f80b92cde80c7242468ddf55f5660774d7884bc
-
memory/820-97-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/820-93-0x000000000040242D-mapping.dmp
-
memory/820-98-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/848-80-0x0000000000000000-mapping.dmp
-
memory/908-54-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/908-55-0x0000000074F50000-0x00000000754FB000-memory.dmpFilesize
5.7MB
-
memory/1708-56-0x0000000000000000-mapping.dmp
-
memory/1912-79-0x0000000074B20000-0x00000000750CB000-memory.dmpFilesize
5.7MB
-
memory/1912-74-0x0000000000000000-mapping.dmp
-
memory/1968-61-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1968-72-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1968-76-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1968-69-0x000000000040242D-mapping.dmp
-
memory/1968-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1968-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1968-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1968-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1968-63-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1968-59-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1968-58-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB