Analysis
-
max time kernel
148s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 11:22
Static task
static1
Behavioral task
behavioral1
Sample
3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe
Resource
win10v2004-20220414-en
General
-
Target
3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe
-
Size
620KB
-
MD5
6ca289e14496ed3f078ddcea8ecea4a4
-
SHA1
7929b23f4c6fe4de022483138e5316ddeb3bf98b
-
SHA256
3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b
-
SHA512
658bd95581cde3e558970dfdf43cbf63067bdb561b7b4756b374c293064e4c41c5e44a12f722eacc4154b094d8d67f4eb52740d2d00de1a05972239993bdb211
Malware Config
Extracted
netwire
xmpphosts.ru:3366
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
mutex
ohviVvrC
-
offline_keylogger
false
-
password
456123xyz
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1348-70-0x0000000000000000-mapping.dmp netwire behavioral1/memory/1348-72-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1348-76-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1348-77-0x0000000000401000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1348-78-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1348-79-0x0000000000401000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1348-80-0x0000000000401000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1348-81-0x0000000000401000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
WinRAR.exeWinRAR.exepid process 1660 WinRAR.exe 1348 WinRAR.exe -
Loads dropped DLL 3 IoCs
Processes:
WScript.exeWinRAR.exepid process 1652 WScript.exe 1652 WScript.exe 1660 WinRAR.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WinRAR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR\\WinRAR.vbs" WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
WinRAR.exedescription pid process target process PID 1660 set thread context of 1348 1660 WinRAR.exe WinRAR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exeWinRAR.exepid process 624 3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe 1660 WinRAR.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exeWScript.exeWinRAR.exedescription pid process target process PID 624 wrote to memory of 1652 624 3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe WScript.exe PID 624 wrote to memory of 1652 624 3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe WScript.exe PID 624 wrote to memory of 1652 624 3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe WScript.exe PID 624 wrote to memory of 1652 624 3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe WScript.exe PID 1652 wrote to memory of 1660 1652 WScript.exe WinRAR.exe PID 1652 wrote to memory of 1660 1652 WScript.exe WinRAR.exe PID 1652 wrote to memory of 1660 1652 WScript.exe WinRAR.exe PID 1652 wrote to memory of 1660 1652 WScript.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe PID 1660 wrote to memory of 1348 1660 WinRAR.exe WinRAR.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe"C:\Users\Admin\AppData\Local\Temp\3952a3de4723e972b996401510de66b006d2c19dcebb488b013a7c116277351b.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.vbs"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exe"C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exe"C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exeFilesize
620KB
MD5deb606acc84fc2818254dc07d1f6c2ac
SHA17638dfd79ba4fbd94a40f83f56f74ee2b6ae0e1a
SHA2569d2c040053b8ecf9744b3f0bb9b06554985d3b6fe2ef354a8794b4c0885fed6c
SHA5120cba279bbb65ac56a837fb4e179d19ffb78cc16068557bb194b9030cf95abdf514a782d7745313c4933557c9213c9949cf81ba0c40b09b6d885e1b97020943ee
-
C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exeFilesize
620KB
MD5deb606acc84fc2818254dc07d1f6c2ac
SHA17638dfd79ba4fbd94a40f83f56f74ee2b6ae0e1a
SHA2569d2c040053b8ecf9744b3f0bb9b06554985d3b6fe2ef354a8794b4c0885fed6c
SHA5120cba279bbb65ac56a837fb4e179d19ffb78cc16068557bb194b9030cf95abdf514a782d7745313c4933557c9213c9949cf81ba0c40b09b6d885e1b97020943ee
-
C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exeFilesize
620KB
MD5deb606acc84fc2818254dc07d1f6c2ac
SHA17638dfd79ba4fbd94a40f83f56f74ee2b6ae0e1a
SHA2569d2c040053b8ecf9744b3f0bb9b06554985d3b6fe2ef354a8794b4c0885fed6c
SHA5120cba279bbb65ac56a837fb4e179d19ffb78cc16068557bb194b9030cf95abdf514a782d7745313c4933557c9213c9949cf81ba0c40b09b6d885e1b97020943ee
-
C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.vbsFilesize
1024B
MD523f6a019b4c5a5d8d30284e029670ca1
SHA13750537e50d127d45e33cda44b726d002a93975b
SHA256eb355d1019c118e38d8f319249c4e118a24d2e19d720587f49b1ee8d864d2d26
SHA512fafb39e4426f97f3ac5817a76f10cfad8487d93618f737c4b359f1511d376076bc8d834e3df61c9c113243cfe60e1687d87559847a306e19e4406e1f5921eec0
-
\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exeFilesize
620KB
MD5deb606acc84fc2818254dc07d1f6c2ac
SHA17638dfd79ba4fbd94a40f83f56f74ee2b6ae0e1a
SHA2569d2c040053b8ecf9744b3f0bb9b06554985d3b6fe2ef354a8794b4c0885fed6c
SHA5120cba279bbb65ac56a837fb4e179d19ffb78cc16068557bb194b9030cf95abdf514a782d7745313c4933557c9213c9949cf81ba0c40b09b6d885e1b97020943ee
-
\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exeFilesize
620KB
MD5deb606acc84fc2818254dc07d1f6c2ac
SHA17638dfd79ba4fbd94a40f83f56f74ee2b6ae0e1a
SHA2569d2c040053b8ecf9744b3f0bb9b06554985d3b6fe2ef354a8794b4c0885fed6c
SHA5120cba279bbb65ac56a837fb4e179d19ffb78cc16068557bb194b9030cf95abdf514a782d7745313c4933557c9213c9949cf81ba0c40b09b6d885e1b97020943ee
-
\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR.exeFilesize
620KB
MD5deb606acc84fc2818254dc07d1f6c2ac
SHA17638dfd79ba4fbd94a40f83f56f74ee2b6ae0e1a
SHA2569d2c040053b8ecf9744b3f0bb9b06554985d3b6fe2ef354a8794b4c0885fed6c
SHA5120cba279bbb65ac56a837fb4e179d19ffb78cc16068557bb194b9030cf95abdf514a782d7745313c4933557c9213c9949cf81ba0c40b09b6d885e1b97020943ee
-
memory/624-56-0x0000000000250000-0x0000000000256000-memory.dmpFilesize
24KB
-
memory/624-57-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1348-78-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1348-80-0x0000000000401000-0x000000000042C000-memory.dmpFilesize
172KB
-
memory/1348-70-0x0000000000000000-mapping.dmp
-
memory/1348-72-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1348-83-0x0000000000401000-0x000000000042C000-memory.dmpFilesize
172KB
-
memory/1348-74-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1348-76-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1348-77-0x0000000000401000-0x000000000042C000-memory.dmpFilesize
172KB
-
memory/1348-82-0x0000000000401000-0x000000000042C000-memory.dmpFilesize
172KB
-
memory/1348-79-0x0000000000401000-0x000000000042C000-memory.dmpFilesize
172KB
-
memory/1348-81-0x0000000000401000-0x000000000042C000-memory.dmpFilesize
172KB
-
memory/1652-58-0x0000000000000000-mapping.dmp
-
memory/1660-64-0x0000000000000000-mapping.dmp
-
memory/1660-73-0x0000000000250000-0x0000000000256000-memory.dmpFilesize
24KB