Analysis
-
max time kernel
111s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-06-2022 22:32
Static task
static1
Behavioral task
behavioral1
Sample
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe
Resource
win10v2004-20220414-en
General
-
Target
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe
-
Size
353KB
-
MD5
e17086e3005706b0dedd321a40b05dcf
-
SHA1
d4c20146860571653827169e840f81e8a58b462e
-
SHA256
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
-
SHA512
18038d73b757ded30d73195dcf477fbabf8ea7050cfcea83802d0b9cd8a0a9e1f65cfb6dc1bbde35a326c6e2b82992bc7d81743af748475eb816671440c4d773
Malware Config
Extracted
netwire
pustios.ug:6971
testingskapss.ru:6971
papapamels.ru:6971
testingskapss.su:6971
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
mutex
JTbRfkgY
-
offline_keylogger
false
-
password
ppF7"oRyqm
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4992-149-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/4992-151-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/4992-152-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
svs.exepid process 3748 svs.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exesvs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation svs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svs = "C:\\Users\\Admin\\AppData\\Local\\svs.exe -boot" svs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svs.exedescription pid process target process PID 3748 set thread context of 4992 3748 svs.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 5 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Local\svs.exe\:Zone.Identifier:$DATA cmd.exe File opened for modification C:\Users\Admin\AppData\Local\svs.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\svs.exe:Zone.Identifier cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exesvs.exedescription pid process Token: SeDebugPrivilege 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe Token: SeDebugPrivilege 3748 svs.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.execmd.exesvs.exedescription pid process target process PID 4948 wrote to memory of 2232 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 2232 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 2232 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 3164 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 3164 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 3164 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 2288 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 2288 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 2288 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 256 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 256 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 4948 wrote to memory of 256 4948 35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe cmd.exe PID 256 wrote to memory of 3748 256 cmd.exe svs.exe PID 256 wrote to memory of 3748 256 cmd.exe svs.exe PID 256 wrote to memory of 3748 256 cmd.exe svs.exe PID 3748 wrote to memory of 2464 3748 svs.exe cmd.exe PID 3748 wrote to memory of 2464 3748 svs.exe cmd.exe PID 3748 wrote to memory of 2464 3748 svs.exe cmd.exe PID 3748 wrote to memory of 1516 3748 svs.exe cmd.exe PID 3748 wrote to memory of 1516 3748 svs.exe cmd.exe PID 3748 wrote to memory of 1516 3748 svs.exe cmd.exe PID 3748 wrote to memory of 5048 3748 svs.exe svchost.exe PID 3748 wrote to memory of 5048 3748 svs.exe svchost.exe PID 3748 wrote to memory of 5048 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4392 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4392 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4392 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe PID 3748 wrote to memory of 4992 3748 svs.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe"C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe:Zone.Identifier"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe" "C:\Users\Admin\AppData\Local\svs.exe"2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\svs.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\svs.exe"C:\Users\Admin\AppData\Local\svs.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\svs.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\svs.exe:Zone.Identifier"4⤵
- NTFS ADS
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\svs.exeFilesize
353KB
MD5e17086e3005706b0dedd321a40b05dcf
SHA1d4c20146860571653827169e840f81e8a58b462e
SHA25635f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
SHA51218038d73b757ded30d73195dcf477fbabf8ea7050cfcea83802d0b9cd8a0a9e1f65cfb6dc1bbde35a326c6e2b82992bc7d81743af748475eb816671440c4d773
-
C:\Users\Admin\AppData\Local\svs.exeFilesize
353KB
MD5e17086e3005706b0dedd321a40b05dcf
SHA1d4c20146860571653827169e840f81e8a58b462e
SHA25635f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
SHA51218038d73b757ded30d73195dcf477fbabf8ea7050cfcea83802d0b9cd8a0a9e1f65cfb6dc1bbde35a326c6e2b82992bc7d81743af748475eb816671440c4d773
-
memory/256-139-0x0000000000000000-mapping.dmp
-
memory/1516-144-0x0000000000000000-mapping.dmp
-
memory/2232-132-0x0000000000000000-mapping.dmp
-
memory/2288-138-0x0000000000000000-mapping.dmp
-
memory/2464-143-0x0000000000000000-mapping.dmp
-
memory/3164-136-0x0000000000000000-mapping.dmp
-
memory/3748-145-0x0000000006190000-0x000000000622C000-memory.dmpFilesize
624KB
-
memory/3748-140-0x0000000000000000-mapping.dmp
-
memory/4392-147-0x0000000000000000-mapping.dmp
-
memory/4948-130-0x0000000000280000-0x00000000002DE000-memory.dmpFilesize
376KB
-
memory/4948-134-0x0000000005610000-0x0000000005632000-memory.dmpFilesize
136KB
-
memory/4948-133-0x00000000057A0000-0x0000000005962000-memory.dmpFilesize
1.8MB
-
memory/4948-131-0x0000000004CC0000-0x0000000004D26000-memory.dmpFilesize
408KB
-
memory/4948-137-0x0000000005970000-0x0000000005A02000-memory.dmpFilesize
584KB
-
memory/4948-135-0x0000000005F20000-0x00000000064C4000-memory.dmpFilesize
5.6MB
-
memory/4992-148-0x0000000000000000-mapping.dmp
-
memory/4992-149-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4992-151-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4992-152-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/5048-146-0x0000000000000000-mapping.dmp