Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 06:45
Behavioral task
behavioral1
Sample
ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exe
Resource
win10v2004-20220414-en
General
-
Target
ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exe
-
Size
127KB
-
MD5
5f4dafd68c558d8e3130e3b46cce9137
-
SHA1
21a898f1ea60d6b379c3797dbdbcc396e25f72f1
-
SHA256
ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979
-
SHA512
f9820fa94089e7b05f4f5b2fca236f4ba5b98725999224efc3a066493405dad78723d32021328bb99d272e637ec2e2b727dd23d0927aee61094ec0e5a80a0202
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Install\Host.exe netwire C:\Users\Admin\AppData\Roaming\Install\Host.exe netwire -
Executes dropped EXE 1 IoCs
Processes:
Host.exepid process 4176 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4N3IXX84-X7C0-1FI7-0YT5-2HLCU3K0W152} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4N3IXX84-X7C0-1FI7-0YT5-2HLCU3K0W152}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exedescription pid process target process PID 2868 wrote to memory of 4176 2868 ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exe Host.exe PID 2868 wrote to memory of 4176 2868 ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exe Host.exe PID 2868 wrote to memory of 4176 2868 ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exe"C:\Users\Admin\AppData\Local\Temp\ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
127KB
MD55f4dafd68c558d8e3130e3b46cce9137
SHA121a898f1ea60d6b379c3797dbdbcc396e25f72f1
SHA256ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979
SHA512f9820fa94089e7b05f4f5b2fca236f4ba5b98725999224efc3a066493405dad78723d32021328bb99d272e637ec2e2b727dd23d0927aee61094ec0e5a80a0202
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
127KB
MD55f4dafd68c558d8e3130e3b46cce9137
SHA121a898f1ea60d6b379c3797dbdbcc396e25f72f1
SHA256ba9c93f3cd75fd57d38bdefb00cec30aa447a7eddc8f92b9b759c5edc18cc979
SHA512f9820fa94089e7b05f4f5b2fca236f4ba5b98725999224efc3a066493405dad78723d32021328bb99d272e637ec2e2b727dd23d0927aee61094ec0e5a80a0202
-
memory/4176-130-0x0000000000000000-mapping.dmp