Analysis
-
max time kernel
113s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:06
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE_93.exe
Resource
win7-20220414-en
General
-
Target
QUOTE_93.exe
-
Size
433KB
-
MD5
d519b9590876fd0bc7fe7e62c1f14f9c
-
SHA1
930bc4718ace81ed9d029d1b99c1cd7cf53e2b95
-
SHA256
8d91a07cffa859ef14c1deaf86f49c25003f050d4fed1d18eee1cde88f292697
-
SHA512
9d644709fdce6b603a683b0d481abf005743e1a05198522a843c5b463b1414dbfc8785da52ebbf87acddda51eaf5fa336745cefbbf264f37c21ee8121cfbad39
Malware Config
Extracted
netwire
185.103.96.151:6996
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
- install_path
- keylogger_dir
-
lock_executable
false
- mutex
-
offline_keylogger
false
-
password
Ehimembano1@
-
registry_autorun
false
- startup_name
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4804-135-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4804-137-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4804-138-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
QUOTE_93.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation QUOTE_93.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
QUOTE_93.exedescription pid process target process PID 2816 set thread context of 4804 2816 QUOTE_93.exe QUOTE_93.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
QUOTE_93.exepid process 2816 QUOTE_93.exe 2816 QUOTE_93.exe 2816 QUOTE_93.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
QUOTE_93.exedescription pid process Token: SeDebugPrivilege 2816 QUOTE_93.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
QUOTE_93.exedescription pid process target process PID 2816 wrote to memory of 3428 2816 QUOTE_93.exe schtasks.exe PID 2816 wrote to memory of 3428 2816 QUOTE_93.exe schtasks.exe PID 2816 wrote to memory of 3428 2816 QUOTE_93.exe schtasks.exe PID 2816 wrote to memory of 4592 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4592 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4592 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe PID 2816 wrote to memory of 4804 2816 QUOTE_93.exe QUOTE_93.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTE_93.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE_93.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GtbksiCXNN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA127.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QUOTE_93.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\QUOTE_93.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA127.tmpFilesize
1KB
MD52cde70f2d8631a5b884d154e02638156
SHA1e97c1193a0f58022ba41578f07deef24b65c0b5d
SHA25613c1714c51135514d7444c22a28ecac800c9a973c3fa88ff3378ff5b0acd4abd
SHA51200492309bec1813884e3a3cb255e7e015727656247ba35d607dbcb6132b2375530391df79c78da3e0472905a57e19c44f332104ca16222e2861547f14650677d
-
memory/2816-130-0x0000000075520000-0x0000000075AD1000-memory.dmpFilesize
5.7MB
-
memory/3428-131-0x0000000000000000-mapping.dmp
-
memory/4592-133-0x0000000000000000-mapping.dmp
-
memory/4804-134-0x0000000000000000-mapping.dmp
-
memory/4804-135-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4804-137-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4804-138-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB