Analysis
-
max time kernel
92s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
29-06-2022 06:14
Static task
static1
Behavioral task
behavioral1
Sample
sstw5VHmkS2cGiF.exe
Resource
win7-20220414-en
General
-
Target
sstw5VHmkS2cGiF.exe
-
Size
973KB
-
MD5
89e0f3ba3b0356030882a5d993c44a96
-
SHA1
5aa37d9479803a1fa692974323849d1eaad34328
-
SHA256
4a762e8f8af34dcfcd469d9e9bfb43c977cd878d939527053a46dd580e654c80
-
SHA512
aced63ee766f6c64c795653a889fa11c70f4c227c77c6cd432825837465b7ddb056856f87ea93c79e511f8c65d7dabda7bf47ad881265c556edde9cd22408e0b
Malware Config
Extracted
netwire
20220627.duckdns.org:4736
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
mutex
KmOVkegF
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4816-144-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/4816-145-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/4816-146-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/4816-147-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/4816-162-0x0000000000400000-0x0000000000450000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
sstw5VHmkS2cGiF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation sstw5VHmkS2cGiF.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
sstw5VHmkS2cGiF.exedescription pid process target process PID 2524 set thread context of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
sstw5VHmkS2cGiF.exepowershell.exepowershell.exepid process 2524 sstw5VHmkS2cGiF.exe 2524 sstw5VHmkS2cGiF.exe 1316 powershell.exe 2236 powershell.exe 2524 sstw5VHmkS2cGiF.exe 1316 powershell.exe 2236 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
sstw5VHmkS2cGiF.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2524 sstw5VHmkS2cGiF.exe Token: SeDebugPrivilege 2236 powershell.exe Token: SeDebugPrivilege 1316 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
sstw5VHmkS2cGiF.exedescription pid process target process PID 2524 wrote to memory of 2236 2524 sstw5VHmkS2cGiF.exe powershell.exe PID 2524 wrote to memory of 2236 2524 sstw5VHmkS2cGiF.exe powershell.exe PID 2524 wrote to memory of 2236 2524 sstw5VHmkS2cGiF.exe powershell.exe PID 2524 wrote to memory of 1316 2524 sstw5VHmkS2cGiF.exe powershell.exe PID 2524 wrote to memory of 1316 2524 sstw5VHmkS2cGiF.exe powershell.exe PID 2524 wrote to memory of 1316 2524 sstw5VHmkS2cGiF.exe powershell.exe PID 2524 wrote to memory of 4712 2524 sstw5VHmkS2cGiF.exe schtasks.exe PID 2524 wrote to memory of 4712 2524 sstw5VHmkS2cGiF.exe schtasks.exe PID 2524 wrote to memory of 4712 2524 sstw5VHmkS2cGiF.exe schtasks.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe PID 2524 wrote to memory of 4816 2524 sstw5VHmkS2cGiF.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sstw5VHmkS2cGiF.exe"C:\Users\Admin\AppData\Local\Temp\sstw5VHmkS2cGiF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\sstw5VHmkS2cGiF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KTNWVfSfr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KTNWVfSfr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBDB7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD52a97857af406fe4019538ea063d35264
SHA16f4147b33a5b628bddff0a639b6f9e819942c3c3
SHA256b2e6462238dfd0c681ea72861e3eccd49df0c8f0589a5d86e062578fb62d50a8
SHA512eb83c13c5abc65f512b9f2198f40c3bbd781ed4e5c4bc175468cbdf5b207466432e5ca24ad333a35fae25e0144f6da7f4c1aaec23299e85191adbffca289ffc4
-
C:\Users\Admin\AppData\Local\Temp\tmpBDB7.tmpFilesize
1KB
MD57af7a7c5ec1b53bc9704e5b374b939fe
SHA11164a870ddef5e66853f615c77a1021209a778e6
SHA256c1a2ef508b331b1cda9fec3bc254e18518523996aee43eea9ff5f2d17c7e56b2
SHA5122e57669e54c6a1cda621e3452e15c4bd09b5fd86d809fbb52cdfeb0a9c8f380ca9028bd2702205bbf4f9d531d3597ae6e3f187fa2809c97d70bcdedb13374d99
-
memory/1316-159-0x0000000007E30000-0x0000000007E38000-memory.dmpFilesize
32KB
-
memory/1316-158-0x0000000007E50000-0x0000000007E6A000-memory.dmpFilesize
104KB
-
memory/1316-135-0x0000000000000000-mapping.dmp
-
memory/1316-157-0x0000000007D40000-0x0000000007D4E000-memory.dmpFilesize
56KB
-
memory/1316-156-0x0000000007D90000-0x0000000007E26000-memory.dmpFilesize
600KB
-
memory/1316-138-0x00000000059F0000-0x0000000006018000-memory.dmpFilesize
6.2MB
-
memory/1316-149-0x0000000006DE0000-0x0000000006E12000-memory.dmpFilesize
200KB
-
memory/1316-152-0x0000000006DC0000-0x0000000006DDE000-memory.dmpFilesize
120KB
-
memory/1316-141-0x0000000006150000-0x00000000061B6000-memory.dmpFilesize
408KB
-
memory/1316-151-0x0000000071C10000-0x0000000071C5C000-memory.dmpFilesize
304KB
-
memory/1316-143-0x00000000061C0000-0x0000000006226000-memory.dmpFilesize
408KB
-
memory/2236-154-0x0000000006FC0000-0x0000000006FDA000-memory.dmpFilesize
104KB
-
memory/2236-137-0x00000000023E0000-0x0000000002416000-memory.dmpFilesize
216KB
-
memory/2236-134-0x0000000000000000-mapping.dmp
-
memory/2236-155-0x0000000007030000-0x000000000703A000-memory.dmpFilesize
40KB
-
memory/2236-148-0x0000000005CC0000-0x0000000005CDE000-memory.dmpFilesize
120KB
-
memory/2236-153-0x0000000007610000-0x0000000007C8A000-memory.dmpFilesize
6.5MB
-
memory/2236-140-0x0000000004D00000-0x0000000004D22000-memory.dmpFilesize
136KB
-
memory/2236-150-0x0000000071C10000-0x0000000071C5C000-memory.dmpFilesize
304KB
-
memory/2524-130-0x0000000000080000-0x000000000017A000-memory.dmpFilesize
1000KB
-
memory/2524-133-0x0000000007000000-0x000000000709C000-memory.dmpFilesize
624KB
-
memory/2524-132-0x0000000004CF0000-0x0000000004D82000-memory.dmpFilesize
584KB
-
memory/2524-131-0x00000000051E0000-0x0000000005784000-memory.dmpFilesize
5.6MB
-
memory/4712-136-0x0000000000000000-mapping.dmp
-
memory/4816-142-0x0000000000000000-mapping.dmp
-
memory/4816-144-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4816-147-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4816-145-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4816-146-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4816-162-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB