Analysis
-
max time kernel
67s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 05:28
Static task
static1
Behavioral task
behavioral1
Sample
INV03483287732.exe
Resource
win7-20220715-en
General
-
Target
INV03483287732.exe
-
Size
776KB
-
MD5
47bae5149fb9832906bf16c11296eb5e
-
SHA1
df8c1b31cfe3d63ec5252e86296bc62efceafc05
-
SHA256
f310b643bdb799627e5b28339b5f455129d61bfd4fb50bdc802b052038c7eb1a
-
SHA512
032f6363b9bf234a24105164eda3aa6b047ca9abcbf8ae7b7640087c201847cc87fa5082f8526357f0b1bbb9216ac582344c3498805aa8ab2810ca114ae0ec26
Malware Config
Extracted
netwire
149.102.132.253:3399
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1468-69-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/1468-71-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/1468-72-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/1468-74-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/1468-75-0x000000000041AE7B-mapping.dmp netwire behavioral1/memory/1468-78-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/1468-80-0x0000000000400000-0x0000000000450000-memory.dmp netwire -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
INV03483287732.exedescription pid process target process PID 1448 set thread context of 1468 1448 INV03483287732.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
INV03483287732.exepowershell.exepid process 1448 INV03483287732.exe 1448 INV03483287732.exe 1448 INV03483287732.exe 1448 INV03483287732.exe 1448 INV03483287732.exe 1448 INV03483287732.exe 1728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
INV03483287732.exepowershell.exedescription pid process Token: SeDebugPrivilege 1448 INV03483287732.exe Token: SeDebugPrivilege 1728 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
INV03483287732.exedescription pid process target process PID 1448 wrote to memory of 1728 1448 INV03483287732.exe powershell.exe PID 1448 wrote to memory of 1728 1448 INV03483287732.exe powershell.exe PID 1448 wrote to memory of 1728 1448 INV03483287732.exe powershell.exe PID 1448 wrote to memory of 1728 1448 INV03483287732.exe powershell.exe PID 1448 wrote to memory of 1056 1448 INV03483287732.exe schtasks.exe PID 1448 wrote to memory of 1056 1448 INV03483287732.exe schtasks.exe PID 1448 wrote to memory of 1056 1448 INV03483287732.exe schtasks.exe PID 1448 wrote to memory of 1056 1448 INV03483287732.exe schtasks.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe PID 1448 wrote to memory of 1468 1448 INV03483287732.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV03483287732.exe"C:\Users\Admin\AppData\Local\Temp\INV03483287732.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qdrQEmCoUNC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qdrQEmCoUNC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF538.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF538.tmpFilesize
1KB
MD53fbf0722484b974ab2440eef6814936e
SHA1390546dfcea117c05e4173850195cfb8b3b73e3e
SHA256b6fcd270c233f921b0b6a93a6124d204ff965b958ae26ce4330aa56fdbf6923e
SHA512a059e0eae479df31e8516aaa5f8d0bc92e260ae178f669a7f0fc7da723d1ae92c3c3a0163edb5304d66f51df26863417320943bf2448c76a7daadf055ce23c5b
-
memory/1056-60-0x0000000000000000-mapping.dmp
-
memory/1448-63-0x0000000002270000-0x00000000022BC000-memory.dmpFilesize
304KB
-
memory/1448-55-0x0000000076601000-0x0000000076603000-memory.dmpFilesize
8KB
-
memory/1448-56-0x0000000000430000-0x0000000000446000-memory.dmpFilesize
88KB
-
memory/1448-57-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/1448-58-0x000000000A6C0000-0x000000000A758000-memory.dmpFilesize
608KB
-
memory/1448-54-0x0000000000BD0000-0x0000000000C98000-memory.dmpFilesize
800KB
-
memory/1468-74-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1468-64-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1468-65-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1468-67-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1468-69-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1468-71-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1468-72-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1468-75-0x000000000041AE7B-mapping.dmp
-
memory/1468-78-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1468-80-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1728-59-0x0000000000000000-mapping.dmp
-
memory/1728-79-0x000000006ECF0000-0x000000006F29B000-memory.dmpFilesize
5.7MB