Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-06-2022 22:32
Static task
static1
Behavioral task
behavioral1
Sample
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe
Resource
win10v2004-20220414-en
General
-
Target
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe
-
Size
353KB
-
MD5
e17086e3005706b0dedd321a40b05dcf
-
SHA1
d4c20146860571653827169e840f81e8a58b462e
-
SHA256
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
-
SHA512
18038d73b757ded30d73195dcf477fbabf8ea7050cfcea83802d0b9cd8a0a9e1f65cfb6dc1bbde35a326c6e2b82992bc7d81743af748475eb816671440c4d773
Malware Config
Extracted
netwire
pustios.ug:6971
testingskapss.ru:6971
papapamels.ru:6971
testingskapss.su:6971
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
mutex
JTbRfkgY
-
offline_keylogger
false
-
password
ppF7"oRyqm
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1816-77-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1816-78-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1816-80-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1816-81-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1816-82-0x0000000000402BCB-mapping.dmp netwire behavioral1/memory/1816-85-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1816-86-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
svs.exepid process 1696 svs.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1684 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\svs = "C:\\Users\\Admin\\AppData\\Local\\svs.exe -boot" svs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svs.exedescription pid process target process PID 1696 set thread context of 1816 1696 svs.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 5 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Local\svs.exe\:Zone.Identifier:$DATA cmd.exe File opened for modification C:\Users\Admin\AppData\Local\svs.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\svs.exe:Zone.Identifier cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exesvs.exedescription pid process Token: SeDebugPrivilege 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe Token: SeDebugPrivilege 1696 svs.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.execmd.exesvs.exedescription pid process target process PID 776 wrote to memory of 1872 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1872 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1872 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1872 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1972 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1972 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1972 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1972 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1960 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1960 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1960 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1960 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1684 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1684 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1684 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 776 wrote to memory of 1684 776 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 1684 wrote to memory of 1696 1684 cmd.exe svs.exe PID 1684 wrote to memory of 1696 1684 cmd.exe svs.exe PID 1684 wrote to memory of 1696 1684 cmd.exe svs.exe PID 1684 wrote to memory of 1696 1684 cmd.exe svs.exe PID 1696 wrote to memory of 1768 1696 svs.exe cmd.exe PID 1696 wrote to memory of 1768 1696 svs.exe cmd.exe PID 1696 wrote to memory of 1768 1696 svs.exe cmd.exe PID 1696 wrote to memory of 1768 1696 svs.exe cmd.exe PID 1696 wrote to memory of 272 1696 svs.exe cmd.exe PID 1696 wrote to memory of 272 1696 svs.exe cmd.exe PID 1696 wrote to memory of 272 1696 svs.exe cmd.exe PID 1696 wrote to memory of 272 1696 svs.exe cmd.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe PID 1696 wrote to memory of 1816 1696 svs.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe"C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe" "C:\Users\Admin\AppData\Local\svs.exe"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\svs.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\svs.exe"C:\Users\Admin\AppData\Local\svs.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\svs.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\svs.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\svs.exeFilesize
353KB
MD5e17086e3005706b0dedd321a40b05dcf
SHA1d4c20146860571653827169e840f81e8a58b462e
SHA25635f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
SHA51218038d73b757ded30d73195dcf477fbabf8ea7050cfcea83802d0b9cd8a0a9e1f65cfb6dc1bbde35a326c6e2b82992bc7d81743af748475eb816671440c4d773
-
C:\Users\Admin\AppData\Local\svs.exeFilesize
353KB
MD5e17086e3005706b0dedd321a40b05dcf
SHA1d4c20146860571653827169e840f81e8a58b462e
SHA25635f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
SHA51218038d73b757ded30d73195dcf477fbabf8ea7050cfcea83802d0b9cd8a0a9e1f65cfb6dc1bbde35a326c6e2b82992bc7d81743af748475eb816671440c4d773
-
\Users\Admin\AppData\Local\svs.exeFilesize
353KB
MD5e17086e3005706b0dedd321a40b05dcf
SHA1d4c20146860571653827169e840f81e8a58b462e
SHA25635f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
SHA51218038d73b757ded30d73195dcf477fbabf8ea7050cfcea83802d0b9cd8a0a9e1f65cfb6dc1bbde35a326c6e2b82992bc7d81743af748475eb816671440c4d773
-
memory/272-70-0x0000000000000000-mapping.dmp
-
memory/776-60-0x0000000000A90000-0x0000000000A9C000-memory.dmpFilesize
48KB
-
memory/776-54-0x0000000000060000-0x00000000000BE000-memory.dmpFilesize
376KB
-
memory/776-58-0x00000000007E0000-0x00000000007E8000-memory.dmpFilesize
32KB
-
memory/776-55-0x00000000002A0000-0x00000000002CA000-memory.dmpFilesize
168KB
-
memory/776-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1684-62-0x0000000000000000-mapping.dmp
-
memory/1696-71-0x0000000000CA0000-0x0000000000CAC000-memory.dmpFilesize
48KB
-
memory/1696-65-0x0000000000000000-mapping.dmp
-
memory/1696-67-0x0000000001010000-0x000000000106E000-memory.dmpFilesize
376KB
-
memory/1768-69-0x0000000000000000-mapping.dmp
-
memory/1816-77-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1816-72-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1816-73-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1816-75-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1816-78-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1816-80-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1816-81-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1816-82-0x0000000000402BCB-mapping.dmp
-
memory/1816-85-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1816-86-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1872-57-0x0000000000000000-mapping.dmp
-
memory/1960-61-0x0000000000000000-mapping.dmp
-
memory/1972-59-0x0000000000000000-mapping.dmp