Analysis
-
max time kernel
172s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
#204811.exe
Resource
win7-20220414-en
General
-
Target
#204811.exe
-
Size
287KB
-
MD5
1fb35d8aa5797fbbc4225a095c106552
-
SHA1
cb08a463884542659aa9856d2dd0dd8e5d3f31cb
-
SHA256
fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
-
SHA512
aeb871ca5da00328c3f5742bef2ccd6715f27c76f62db47118237312801f1b7b9672afa5becc67f01d50bc887f80b92cde80c7242468ddf55f5660774d7884bc
Malware Config
Extracted
netwire
ichie02.ddns.net:3360
84.38.135.207:3360
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
true
-
host_id
ICHIE007
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
AcYrNKLE
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1680-134-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1680-136-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1680-140-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4344-148-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4344-149-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 2704 Host.exe 4344 Host.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
#204811.exe#204811.exeHost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation #204811.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation #204811.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
#204811.exeHost.exedescription pid process target process PID 3688 set thread context of 1680 3688 #204811.exe #204811.exe PID 2704 set thread context of 4344 2704 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
#204811.exe#204811.exeHost.exedescription pid process target process PID 3688 wrote to memory of 608 3688 #204811.exe schtasks.exe PID 3688 wrote to memory of 608 3688 #204811.exe schtasks.exe PID 3688 wrote to memory of 608 3688 #204811.exe schtasks.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 3688 wrote to memory of 1680 3688 #204811.exe #204811.exe PID 1680 wrote to memory of 2704 1680 #204811.exe Host.exe PID 1680 wrote to memory of 2704 1680 #204811.exe Host.exe PID 1680 wrote to memory of 2704 1680 #204811.exe Host.exe PID 2704 wrote to memory of 1964 2704 Host.exe schtasks.exe PID 2704 wrote to memory of 1964 2704 Host.exe schtasks.exe PID 2704 wrote to memory of 1964 2704 Host.exe schtasks.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe PID 2704 wrote to memory of 4344 2704 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\#204811.exe"C:\Users\Admin\AppData\Local\Temp\#204811.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PjnzCykUxYlaz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEFAF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\#204811.exe"{path}"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\#204811.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PjnzCykUxYlaz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7A6B.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7A6B.tmpFilesize
1KB
MD5493f9d31bf0d4d35eba23366a2fcb897
SHA13d18740b77382238ff856cad28fd93c49c6bf1ef
SHA256a61fe0829627ec738f99279caf51a2ad54d933e4c4959ec3300592fb3128bb56
SHA5121d85f5102db06583a57b15a2430a1d8e06410465cf0a69d24d1d8c2573fb2347aeeb6c9ba7ccc59503f51095178387f10619d0e6b90e208606bee58407459897
-
C:\Users\Admin\AppData\Local\Temp\tmpEFAF.tmpFilesize
1KB
MD5493f9d31bf0d4d35eba23366a2fcb897
SHA13d18740b77382238ff856cad28fd93c49c6bf1ef
SHA256a61fe0829627ec738f99279caf51a2ad54d933e4c4959ec3300592fb3128bb56
SHA5121d85f5102db06583a57b15a2430a1d8e06410465cf0a69d24d1d8c2573fb2347aeeb6c9ba7ccc59503f51095178387f10619d0e6b90e208606bee58407459897
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
287KB
MD51fb35d8aa5797fbbc4225a095c106552
SHA1cb08a463884542659aa9856d2dd0dd8e5d3f31cb
SHA256fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
SHA512aeb871ca5da00328c3f5742bef2ccd6715f27c76f62db47118237312801f1b7b9672afa5becc67f01d50bc887f80b92cde80c7242468ddf55f5660774d7884bc
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
287KB
MD51fb35d8aa5797fbbc4225a095c106552
SHA1cb08a463884542659aa9856d2dd0dd8e5d3f31cb
SHA256fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
SHA512aeb871ca5da00328c3f5742bef2ccd6715f27c76f62db47118237312801f1b7b9672afa5becc67f01d50bc887f80b92cde80c7242468ddf55f5660774d7884bc
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
287KB
MD51fb35d8aa5797fbbc4225a095c106552
SHA1cb08a463884542659aa9856d2dd0dd8e5d3f31cb
SHA256fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
SHA512aeb871ca5da00328c3f5742bef2ccd6715f27c76f62db47118237312801f1b7b9672afa5becc67f01d50bc887f80b92cde80c7242468ddf55f5660774d7884bc
-
memory/608-131-0x0000000000000000-mapping.dmp
-
memory/1680-134-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1680-140-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1680-136-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1680-133-0x0000000000000000-mapping.dmp
-
memory/1964-142-0x0000000000000000-mapping.dmp
-
memory/2704-137-0x0000000000000000-mapping.dmp
-
memory/2704-141-0x00000000737E0000-0x0000000073D91000-memory.dmpFilesize
5.7MB
-
memory/3688-130-0x0000000074960000-0x0000000074F11000-memory.dmpFilesize
5.7MB
-
memory/4344-144-0x0000000000000000-mapping.dmp
-
memory/4344-148-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4344-149-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB