Analysis
-
max time kernel
98s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 04:17
Behavioral task
behavioral1
Sample
ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exe
Resource
win10v2004-20220414-en
General
-
Target
ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exe
-
Size
148KB
-
MD5
3ecf5570135182164ad58082f45bd810
-
SHA1
1d2620cd90ee414bbef359b69a228a68036cd2b2
-
SHA256
ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954
-
SHA512
262d312ee79b6cab44c8129b358127ebd84524496e219e955227f46c8a296750b7e87e7d7bcb7c02934bd52e652874bdcc0ba4cb5696e17df424db498bb674fc
Malware Config
Extracted
netwire
tubyeko.ddns.net:1363
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
cimala12345
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Install\Host.exe netwire C:\Users\Admin\AppData\Roaming\Install\Host.exe netwire -
Executes dropped EXE 1 IoCs
Processes:
Host.exepid process 3452 Host.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exedescription pid process target process PID 4304 wrote to memory of 3452 4304 ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exe Host.exe PID 4304 wrote to memory of 3452 4304 ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exe Host.exe PID 4304 wrote to memory of 3452 4304 ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exe"C:\Users\Admin\AppData\Local\Temp\ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
148KB
MD53ecf5570135182164ad58082f45bd810
SHA11d2620cd90ee414bbef359b69a228a68036cd2b2
SHA256ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954
SHA512262d312ee79b6cab44c8129b358127ebd84524496e219e955227f46c8a296750b7e87e7d7bcb7c02934bd52e652874bdcc0ba4cb5696e17df424db498bb674fc
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
148KB
MD53ecf5570135182164ad58082f45bd810
SHA11d2620cd90ee414bbef359b69a228a68036cd2b2
SHA256ec5de5b44d3d1d71078879e33ba531af86e776ca86d4558b4fac7b7884918954
SHA512262d312ee79b6cab44c8129b358127ebd84524496e219e955227f46c8a296750b7e87e7d7bcb7c02934bd52e652874bdcc0ba4cb5696e17df424db498bb674fc
-
memory/3452-130-0x0000000000000000-mapping.dmp