Analysis
-
max time kernel
139s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:03
Static task
static1
Behavioral task
behavioral1
Sample
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe
Resource
win10v2004-20220414-en
General
-
Target
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe
-
Size
618KB
-
MD5
8c55cba01db3ea37db03917b97c49b2f
-
SHA1
e86a93f9b85527e330a2c03e01d243ce38231c09
-
SHA256
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd
-
SHA512
801c578d0a5910210c16143aa1f7911a228d8f17c301773316c36b1ea42bbc9ef0c5b70cc363bcdf4df837f701f55fd23602c3fd025d70462912a6d871420efd
Malware Config
Extracted
netwire
fdghfghdfghjhgjkgfgjh234569.ru:6974
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
a2nw
- install_path
- keylogger_dir
-
lock_executable
false
-
mutex
NrPiWfVe
-
offline_keylogger
false
-
password
rdfs34df32sdf
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-78-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/2040-79-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/2040-81-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/2040-82-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/2040-83-0x0000000000402570-mapping.dmp netwire behavioral1/memory/2040-86-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/2040-87-0x0000000000400000-0x0000000000425000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
sdvbcxs.exepid process 268 sdvbcxs.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1132 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
sdvbcxs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdvbcxs = "C:\\Users\\Admin\\AppData\\Local\\sdvbcxs.exe -boot" sdvbcxs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sdvbcxs.exedescription pid process target process PID 268 set thread context of 2040 268 sdvbcxs.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 5 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Local\sdvbcxs.exe\:Zone.Identifier:$DATA cmd.exe File opened for modification C:\Users\Admin\AppData\Local\sdvbcxs.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\sdvbcxs.exe:Zone.Identifier cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exesdvbcxs.exedescription pid process Token: SeDebugPrivilege 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe Token: SeDebugPrivilege 268 sdvbcxs.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.execmd.exesdvbcxs.exedescription pid process target process PID 1172 wrote to memory of 1392 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1392 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1392 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1392 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1704 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1704 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1704 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1704 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 2028 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 2028 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 2028 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 2028 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1132 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1132 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1132 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1172 wrote to memory of 1132 1172 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1132 wrote to memory of 268 1132 cmd.exe sdvbcxs.exe PID 1132 wrote to memory of 268 1132 cmd.exe sdvbcxs.exe PID 1132 wrote to memory of 268 1132 cmd.exe sdvbcxs.exe PID 1132 wrote to memory of 268 1132 cmd.exe sdvbcxs.exe PID 1132 wrote to memory of 268 1132 cmd.exe sdvbcxs.exe PID 1132 wrote to memory of 268 1132 cmd.exe sdvbcxs.exe PID 1132 wrote to memory of 268 1132 cmd.exe sdvbcxs.exe PID 268 wrote to memory of 1056 268 sdvbcxs.exe cmd.exe PID 268 wrote to memory of 1056 268 sdvbcxs.exe cmd.exe PID 268 wrote to memory of 1056 268 sdvbcxs.exe cmd.exe PID 268 wrote to memory of 1056 268 sdvbcxs.exe cmd.exe PID 268 wrote to memory of 696 268 sdvbcxs.exe cmd.exe PID 268 wrote to memory of 696 268 sdvbcxs.exe cmd.exe PID 268 wrote to memory of 696 268 sdvbcxs.exe cmd.exe PID 268 wrote to memory of 696 268 sdvbcxs.exe cmd.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe PID 268 wrote to memory of 2040 268 sdvbcxs.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe"C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe" "C:\Users\Admin\AppData\Local\sdvbcxs.exe"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\sdvbcxs.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\sdvbcxs.exe"C:\Users\Admin\AppData\Local\sdvbcxs.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\sdvbcxs.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\sdvbcxs.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\sdvbcxs.exeFilesize
618KB
MD58c55cba01db3ea37db03917b97c49b2f
SHA1e86a93f9b85527e330a2c03e01d243ce38231c09
SHA256b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd
SHA512801c578d0a5910210c16143aa1f7911a228d8f17c301773316c36b1ea42bbc9ef0c5b70cc363bcdf4df837f701f55fd23602c3fd025d70462912a6d871420efd
-
C:\Users\Admin\AppData\Local\sdvbcxs.exeFilesize
618KB
MD58c55cba01db3ea37db03917b97c49b2f
SHA1e86a93f9b85527e330a2c03e01d243ce38231c09
SHA256b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd
SHA512801c578d0a5910210c16143aa1f7911a228d8f17c301773316c36b1ea42bbc9ef0c5b70cc363bcdf4df837f701f55fd23602c3fd025d70462912a6d871420efd
-
\Users\Admin\AppData\Local\sdvbcxs.exeFilesize
618KB
MD58c55cba01db3ea37db03917b97c49b2f
SHA1e86a93f9b85527e330a2c03e01d243ce38231c09
SHA256b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd
SHA512801c578d0a5910210c16143aa1f7911a228d8f17c301773316c36b1ea42bbc9ef0c5b70cc363bcdf4df837f701f55fd23602c3fd025d70462912a6d871420efd
-
memory/268-72-0x0000000004960000-0x000000000496C000-memory.dmpFilesize
48KB
-
memory/268-68-0x0000000000E50000-0x0000000000EEE000-memory.dmpFilesize
632KB
-
memory/268-66-0x0000000000000000-mapping.dmp
-
memory/696-71-0x0000000000000000-mapping.dmp
-
memory/1056-70-0x0000000000000000-mapping.dmp
-
memory/1132-63-0x0000000000000000-mapping.dmp
-
memory/1172-61-0x0000000002060000-0x0000000002066000-memory.dmpFilesize
24KB
-
memory/1172-54-0x0000000000210000-0x00000000002AE000-memory.dmpFilesize
632KB
-
memory/1172-60-0x00000000005B0000-0x00000000005BC000-memory.dmpFilesize
48KB
-
memory/1172-58-0x0000000001FA0000-0x0000000001FAA000-memory.dmpFilesize
40KB
-
memory/1172-56-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/1172-55-0x00000000003C0000-0x00000000003EC000-memory.dmpFilesize
176KB
-
memory/1392-57-0x0000000000000000-mapping.dmp
-
memory/1704-59-0x0000000000000000-mapping.dmp
-
memory/2028-62-0x0000000000000000-mapping.dmp
-
memory/2040-73-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2040-74-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2040-76-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2040-78-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2040-79-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2040-81-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2040-82-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2040-83-0x0000000000402570-mapping.dmp
-
memory/2040-86-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2040-87-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB