Analysis
-
max time kernel
169s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 07:14
Behavioral task
behavioral1
Sample
f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exe
Resource
win10v2004-20220414-en
General
-
Target
f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exe
-
Size
105KB
-
MD5
e41a15ffc2f84d3322f9cc3cf8b101ad
-
SHA1
616719ba3558c03eea84d011abd2e04b1f592bb8
-
SHA256
f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d
-
SHA512
53ad95d5352d42ae6a6f57485770dba3d20067403367da4f3f0203a37902aa5b2eb8b28a835e1f60c694f520fa728229f9a83c8095c430fbd2d0e5f13367a783
Malware Config
Extracted
netwire
akachi07.mmafan.biz:8757
-
activex_autorun
true
-
activex_key
{2KYFY1VI-7E18-DV7K-3B2P-6SQAJ3II7S61}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
Neq app
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Install\Host.exe netwire C:\Users\Admin\AppData\Roaming\Install\Host.exe netwire -
Executes dropped EXE 1 IoCs
Processes:
Host.exepid process 4896 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2KYFY1VI-7E18-DV7K-3B2P-6SQAJ3II7S61} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2KYFY1VI-7E18-DV7K-3B2P-6SQAJ3II7S61}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Neq app = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exedescription pid process target process PID 2368 wrote to memory of 4896 2368 f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exe Host.exe PID 2368 wrote to memory of 4896 2368 f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exe"C:\Users\Admin\AppData\Local\Temp\f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
105KB
MD5e41a15ffc2f84d3322f9cc3cf8b101ad
SHA1616719ba3558c03eea84d011abd2e04b1f592bb8
SHA256f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d
SHA51253ad95d5352d42ae6a6f57485770dba3d20067403367da4f3f0203a37902aa5b2eb8b28a835e1f60c694f520fa728229f9a83c8095c430fbd2d0e5f13367a783
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
105KB
MD5e41a15ffc2f84d3322f9cc3cf8b101ad
SHA1616719ba3558c03eea84d011abd2e04b1f592bb8
SHA256f4538fc39c627a098bdc55331db0bd1661c2257b061bb3783ed1c7cc55afdb7d
SHA51253ad95d5352d42ae6a6f57485770dba3d20067403367da4f3f0203a37902aa5b2eb8b28a835e1f60c694f520fa728229f9a83c8095c430fbd2d0e5f13367a783
-
memory/4896-130-0x0000000000000000-mapping.dmp