Analysis
-
max time kernel
125s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:03
Static task
static1
Behavioral task
behavioral1
Sample
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe
Resource
win10v2004-20220414-en
General
-
Target
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe
-
Size
618KB
-
MD5
8c55cba01db3ea37db03917b97c49b2f
-
SHA1
e86a93f9b85527e330a2c03e01d243ce38231c09
-
SHA256
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd
-
SHA512
801c578d0a5910210c16143aa1f7911a228d8f17c301773316c36b1ea42bbc9ef0c5b70cc363bcdf4df837f701f55fd23602c3fd025d70462912a6d871420efd
Malware Config
Extracted
netwire
fdghfghdfghjhgjkgfgjh234569.ru:6974
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
a2nw
- install_path
- keylogger_dir
-
lock_executable
false
-
mutex
NrPiWfVe
-
offline_keylogger
false
-
password
rdfs34df32sdf
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3676-149-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral2/memory/3676-151-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral2/memory/3676-152-0x0000000000400000-0x0000000000425000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
sdvbcxs.exepid process 1868 sdvbcxs.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exesdvbcxs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation sdvbcxs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
sdvbcxs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdvbcxs = "C:\\Users\\Admin\\AppData\\Local\\sdvbcxs.exe -boot" sdvbcxs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sdvbcxs.exedescription pid process target process PID 1868 set thread context of 3676 1868 sdvbcxs.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 5 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\sdvbcxs.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\sdvbcxs.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Local\sdvbcxs.exe\:Zone.Identifier:$DATA cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exesdvbcxs.exedescription pid process Token: SeDebugPrivilege 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe Token: SeDebugPrivilege 1868 sdvbcxs.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.execmd.exesdvbcxs.exedescription pid process target process PID 2224 wrote to memory of 3176 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 3176 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 3176 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 4176 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 4176 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 4176 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 1288 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 1288 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 1288 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 1020 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 1020 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 2224 wrote to memory of 1020 2224 b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe cmd.exe PID 1020 wrote to memory of 1868 1020 cmd.exe sdvbcxs.exe PID 1020 wrote to memory of 1868 1020 cmd.exe sdvbcxs.exe PID 1020 wrote to memory of 1868 1020 cmd.exe sdvbcxs.exe PID 1868 wrote to memory of 4820 1868 sdvbcxs.exe cmd.exe PID 1868 wrote to memory of 4820 1868 sdvbcxs.exe cmd.exe PID 1868 wrote to memory of 4820 1868 sdvbcxs.exe cmd.exe PID 1868 wrote to memory of 3000 1868 sdvbcxs.exe cmd.exe PID 1868 wrote to memory of 3000 1868 sdvbcxs.exe cmd.exe PID 1868 wrote to memory of 3000 1868 sdvbcxs.exe cmd.exe PID 1868 wrote to memory of 4984 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 4984 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 4984 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 1036 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 1036 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 1036 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe PID 1868 wrote to memory of 3676 1868 sdvbcxs.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe"C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd.exe" "C:\Users\Admin\AppData\Local\sdvbcxs.exe"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\sdvbcxs.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\sdvbcxs.exe"C:\Users\Admin\AppData\Local\sdvbcxs.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\sdvbcxs.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\sdvbcxs.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\sdvbcxs.exeFilesize
618KB
MD58c55cba01db3ea37db03917b97c49b2f
SHA1e86a93f9b85527e330a2c03e01d243ce38231c09
SHA256b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd
SHA512801c578d0a5910210c16143aa1f7911a228d8f17c301773316c36b1ea42bbc9ef0c5b70cc363bcdf4df837f701f55fd23602c3fd025d70462912a6d871420efd
-
C:\Users\Admin\AppData\Local\sdvbcxs.exeFilesize
618KB
MD58c55cba01db3ea37db03917b97c49b2f
SHA1e86a93f9b85527e330a2c03e01d243ce38231c09
SHA256b4342b4b5f8e08badc18fc540b8da2c526fb1b9b1988f87fd877648f53e952cd
SHA512801c578d0a5910210c16143aa1f7911a228d8f17c301773316c36b1ea42bbc9ef0c5b70cc363bcdf4df837f701f55fd23602c3fd025d70462912a6d871420efd
-
memory/1020-139-0x0000000000000000-mapping.dmp
-
memory/1036-147-0x0000000000000000-mapping.dmp
-
memory/1288-138-0x0000000000000000-mapping.dmp
-
memory/1868-145-0x0000000006A40000-0x0000000006ADC000-memory.dmpFilesize
624KB
-
memory/1868-140-0x0000000000000000-mapping.dmp
-
memory/2224-130-0x0000000000250000-0x00000000002EE000-memory.dmpFilesize
632KB
-
memory/2224-137-0x00000000059E0000-0x0000000005A72000-memory.dmpFilesize
584KB
-
memory/2224-135-0x0000000005B10000-0x0000000005CD2000-memory.dmpFilesize
1.8MB
-
memory/2224-134-0x0000000005EF0000-0x0000000006494000-memory.dmpFilesize
5.6MB
-
memory/2224-131-0x0000000004E90000-0x0000000004EB2000-memory.dmpFilesize
136KB
-
memory/2224-132-0x0000000004F30000-0x0000000004F96000-memory.dmpFilesize
408KB
-
memory/3000-144-0x0000000000000000-mapping.dmp
-
memory/3176-133-0x0000000000000000-mapping.dmp
-
memory/3676-148-0x0000000000000000-mapping.dmp
-
memory/3676-149-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3676-151-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3676-152-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4176-136-0x0000000000000000-mapping.dmp
-
memory/4820-143-0x0000000000000000-mapping.dmp
-
memory/4984-146-0x0000000000000000-mapping.dmp