Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-06-2022 13:26
Static task
static1
Behavioral task
behavioral1
Sample
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe
Resource
win10v2004-20220414-en
General
-
Target
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe
-
Size
137KB
-
MD5
65d209ca2059c2246557a4e01e018ba8
-
SHA1
b7bf68ef1f74e33b530025cca086fa503c1c9e15
-
SHA256
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0
-
SHA512
6bcd1f5cd9c009e5c23614a8d5f470e34d7f825a8322402e935b58018c8aae3ecc8d229f98ecc8b73606c4216e30866ed5362e48442ffd844f378a27dbc09529
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3248-138-0x0000000000400000-0x0000000000418000-memory.dmp netwire behavioral2/memory/4196-150-0x0000000000400000-0x0000000000418000-memory.dmp netwire behavioral2/memory/4196-152-0x0000000000400000-0x0000000000418000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
system.exesystem.exepid process 444 system.exe 4196 system.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
system.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{SA8500OJ-3T4J-65P5-K3AS-I8L75JD0EUEO} system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{SA8500OJ-3T4J-65P5-K3AS-I8L75JD0EUEO}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\system.exe\"" system.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
system.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ system.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\system.exe" system.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exesystem.exedescription pid process target process PID 4976 set thread context of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 444 set thread context of 4196 444 system.exe system.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exesystem.exedescription pid process target process PID 4976 wrote to memory of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 4976 wrote to memory of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 4976 wrote to memory of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 4976 wrote to memory of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 4976 wrote to memory of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 4976 wrote to memory of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 4976 wrote to memory of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 4976 wrote to memory of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 4976 wrote to memory of 3248 4976 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe PID 3248 wrote to memory of 444 3248 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe system.exe PID 3248 wrote to memory of 444 3248 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe system.exe PID 3248 wrote to memory of 444 3248 101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe system.exe PID 444 wrote to memory of 4196 444 system.exe system.exe PID 444 wrote to memory of 4196 444 system.exe system.exe PID 444 wrote to memory of 4196 444 system.exe system.exe PID 444 wrote to memory of 4196 444 system.exe system.exe PID 444 wrote to memory of 4196 444 system.exe system.exe PID 444 wrote to memory of 4196 444 system.exe system.exe PID 444 wrote to memory of 4196 444 system.exe system.exe PID 444 wrote to memory of 4196 444 system.exe system.exe PID 444 wrote to memory of 4196 444 system.exe system.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe"C:\Users\Admin\AppData\Local\Temp\101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe"C:\Users\Admin\AppData\Local\Temp\101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\system.exe"C:\Users\Admin\AppData\Roaming\Install\system.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\system.exe"C:\Users\Admin\AppData\Roaming\Install\system.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\system.exeFilesize
137KB
MD565d209ca2059c2246557a4e01e018ba8
SHA1b7bf68ef1f74e33b530025cca086fa503c1c9e15
SHA256101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0
SHA5126bcd1f5cd9c009e5c23614a8d5f470e34d7f825a8322402e935b58018c8aae3ecc8d229f98ecc8b73606c4216e30866ed5362e48442ffd844f378a27dbc09529
-
C:\Users\Admin\AppData\Roaming\Install\system.exeFilesize
137KB
MD565d209ca2059c2246557a4e01e018ba8
SHA1b7bf68ef1f74e33b530025cca086fa503c1c9e15
SHA256101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0
SHA5126bcd1f5cd9c009e5c23614a8d5f470e34d7f825a8322402e935b58018c8aae3ecc8d229f98ecc8b73606c4216e30866ed5362e48442ffd844f378a27dbc09529
-
C:\Users\Admin\AppData\Roaming\Install\system.exeFilesize
137KB
MD565d209ca2059c2246557a4e01e018ba8
SHA1b7bf68ef1f74e33b530025cca086fa503c1c9e15
SHA256101e53d25bfa7afdaa3fc2eabcba839f5afde1ab53cb585a036948ef0c1817b0
SHA5126bcd1f5cd9c009e5c23614a8d5f470e34d7f825a8322402e935b58018c8aae3ecc8d229f98ecc8b73606c4216e30866ed5362e48442ffd844f378a27dbc09529
-
memory/444-142-0x00000000738C0000-0x0000000073E71000-memory.dmpFilesize
5.7MB
-
memory/444-139-0x0000000000000000-mapping.dmp
-
memory/444-149-0x00000000738C0000-0x0000000073E71000-memory.dmpFilesize
5.7MB
-
memory/444-143-0x0000000072BF0000-0x00000000736F0000-memory.dmpFilesize
11.0MB
-
memory/444-151-0x0000000072BF0000-0x00000000736F0000-memory.dmpFilesize
11.0MB
-
memory/3248-138-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3248-134-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3248-132-0x0000000000000000-mapping.dmp
-
memory/3248-135-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3248-133-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4196-152-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4196-144-0x0000000000000000-mapping.dmp
-
memory/4196-150-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4196-148-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4976-131-0x0000000073900000-0x0000000074400000-memory.dmpFilesize
11.0MB
-
memory/4976-130-0x0000000074B00000-0x00000000750B1000-memory.dmpFilesize
5.7MB
-
memory/4976-137-0x0000000073900000-0x0000000074400000-memory.dmpFilesize
11.0MB
-
memory/4976-136-0x0000000074B00000-0x00000000750B1000-memory.dmpFilesize
5.7MB