Analysis
-
max time kernel
125s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
e40fb6f7b8378a9d0606cfac8eb60f5d.exe
Resource
win7-20220715-en
General
-
Target
e40fb6f7b8378a9d0606cfac8eb60f5d.exe
-
Size
696KB
-
MD5
e40fb6f7b8378a9d0606cfac8eb60f5d
-
SHA1
b8da9767ceeec76d7b465db3ad098f740f97c35e
-
SHA256
024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
-
SHA512
9225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4272-143-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4272-146-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4272-151-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4804-172-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4804-174-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 3120 Host.exe 4804 Host.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e40fb6f7b8378a9d0606cfac8eb60f5d.exee40fb6f7b8378a9d0606cfac8eb60f5d.exeHost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation e40fb6f7b8378a9d0606cfac8eb60f5d.exe Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation e40fb6f7b8378a9d0606cfac8eb60f5d.exe Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e40fb6f7b8378a9d0606cfac8eb60f5d.exeHost.exedescription pid process target process PID 1356 set thread context of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 3120 set thread context of 4804 3120 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4500 schtasks.exe 1520 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
e40fb6f7b8378a9d0606cfac8eb60f5d.exepowershell.exeHost.exepowershell.exepid process 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe 4788 powershell.exe 4788 powershell.exe 3120 Host.exe 3120 Host.exe 2736 powershell.exe 2736 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
e40fb6f7b8378a9d0606cfac8eb60f5d.exepowershell.exeHost.exepowershell.exedescription pid process Token: SeDebugPrivilege 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe Token: SeDebugPrivilege 4788 powershell.exe Token: SeDebugPrivilege 3120 Host.exe Token: SeDebugPrivilege 2736 powershell.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
e40fb6f7b8378a9d0606cfac8eb60f5d.exee40fb6f7b8378a9d0606cfac8eb60f5d.exeHost.exedescription pid process target process PID 1356 wrote to memory of 4788 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe powershell.exe PID 1356 wrote to memory of 4788 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe powershell.exe PID 1356 wrote to memory of 4788 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe powershell.exe PID 1356 wrote to memory of 4500 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe schtasks.exe PID 1356 wrote to memory of 4500 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe schtasks.exe PID 1356 wrote to memory of 4500 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe schtasks.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 1356 wrote to memory of 4272 1356 e40fb6f7b8378a9d0606cfac8eb60f5d.exe e40fb6f7b8378a9d0606cfac8eb60f5d.exe PID 4272 wrote to memory of 3120 4272 e40fb6f7b8378a9d0606cfac8eb60f5d.exe Host.exe PID 4272 wrote to memory of 3120 4272 e40fb6f7b8378a9d0606cfac8eb60f5d.exe Host.exe PID 4272 wrote to memory of 3120 4272 e40fb6f7b8378a9d0606cfac8eb60f5d.exe Host.exe PID 3120 wrote to memory of 2736 3120 Host.exe powershell.exe PID 3120 wrote to memory of 2736 3120 Host.exe powershell.exe PID 3120 wrote to memory of 2736 3120 Host.exe powershell.exe PID 3120 wrote to memory of 1520 3120 Host.exe schtasks.exe PID 3120 wrote to memory of 1520 3120 Host.exe schtasks.exe PID 3120 wrote to memory of 1520 3120 Host.exe schtasks.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe PID 3120 wrote to memory of 4804 3120 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e40fb6f7b8378a9d0606cfac8eb60f5d.exe"C:\Users\Admin\AppData\Local\Temp\e40fb6f7b8378a9d0606cfac8eb60f5d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QrFwdapUjOrhP.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QrFwdapUjOrhP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F13.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\e40fb6f7b8378a9d0606cfac8eb60f5d.exe"C:\Users\Admin\AppData\Local\Temp\e40fb6f7b8378a9d0606cfac8eb60f5d.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QrFwdapUjOrhP.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QrFwdapUjOrhP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F75.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD572df41592d77fc3128484c6f60c1682b
SHA1907b73a76dec88fc6bc8f97570d95e0d99695b11
SHA25623a51318eb28c951d91712e0ee55a1d134bb240a49e82a0e5736cc3abdb23ebe
SHA51256528952bb384567b96a5df70222d2b6279d43da8bc8cd6566618fb30d6a35e8a2763cbc8e6887f27469d33ebde7580adab8379607d1d267aff248e50f342875
-
C:\Users\Admin\AppData\Local\Temp\tmp1F75.tmpFilesize
1KB
MD581f882be88a0b608bab578271f803f3b
SHA175cc9b7652665356166cdb575b6f0841d1d3947a
SHA2562667e5d382122d3311544fa8e93ff21dd2685b906b893e13573c3a864242923a
SHA512e6891363c97727c26c183eeaf5a587427ca124575e0d90739584decf370a2c05e44e44d32feb345586113cfdcc47d1d036d23859ba3bf947bca254b3e6a65db1
-
C:\Users\Admin\AppData\Local\Temp\tmp5F13.tmpFilesize
1KB
MD581f882be88a0b608bab578271f803f3b
SHA175cc9b7652665356166cdb575b6f0841d1d3947a
SHA2562667e5d382122d3311544fa8e93ff21dd2685b906b893e13573c3a864242923a
SHA512e6891363c97727c26c183eeaf5a587427ca124575e0d90739584decf370a2c05e44e44d32feb345586113cfdcc47d1d036d23859ba3bf947bca254b3e6a65db1
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
memory/1356-137-0x00000000075A0000-0x0000000007606000-memory.dmpFilesize
408KB
-
memory/1356-134-0x0000000005250000-0x00000000052E2000-memory.dmpFilesize
584KB
-
memory/1356-132-0x0000000000770000-0x0000000000824000-memory.dmpFilesize
720KB
-
memory/1356-133-0x0000000005800000-0x0000000005DA4000-memory.dmpFilesize
5.6MB
-
memory/1356-135-0x00000000051D0000-0x00000000051DA000-memory.dmpFilesize
40KB
-
memory/1356-136-0x00000000074C0000-0x000000000755C000-memory.dmpFilesize
624KB
-
memory/1520-165-0x0000000000000000-mapping.dmp
-
memory/2736-164-0x0000000000000000-mapping.dmp
-
memory/2736-175-0x0000000070BD0000-0x0000000070C1C000-memory.dmpFilesize
304KB
-
memory/3120-149-0x0000000000000000-mapping.dmp
-
memory/4272-146-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4272-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4272-142-0x0000000000000000-mapping.dmp
-
memory/4272-151-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4500-139-0x0000000000000000-mapping.dmp
-
memory/4788-153-0x0000000006260000-0x000000000627E000-memory.dmpFilesize
120KB
-
memory/4788-155-0x0000000072180000-0x00000000721CC000-memory.dmpFilesize
304KB
-
memory/4788-157-0x0000000007BB0000-0x000000000822A000-memory.dmpFilesize
6.5MB
-
memory/4788-158-0x0000000007570000-0x000000000758A000-memory.dmpFilesize
104KB
-
memory/4788-159-0x00000000075F0000-0x00000000075FA000-memory.dmpFilesize
40KB
-
memory/4788-160-0x0000000007800000-0x0000000007896000-memory.dmpFilesize
600KB
-
memory/4788-161-0x00000000077B0000-0x00000000077BE000-memory.dmpFilesize
56KB
-
memory/4788-162-0x00000000078C0000-0x00000000078DA000-memory.dmpFilesize
104KB
-
memory/4788-163-0x00000000078A0000-0x00000000078A8000-memory.dmpFilesize
32KB
-
memory/4788-156-0x0000000006840000-0x000000000685E000-memory.dmpFilesize
120KB
-
memory/4788-154-0x0000000007230000-0x0000000007262000-memory.dmpFilesize
200KB
-
memory/4788-148-0x0000000005440000-0x00000000054A6000-memory.dmpFilesize
408KB
-
memory/4788-147-0x00000000051A0000-0x00000000051C2000-memory.dmpFilesize
136KB
-
memory/4788-138-0x0000000000000000-mapping.dmp
-
memory/4788-144-0x00000000054C0000-0x0000000005AE8000-memory.dmpFilesize
6.2MB
-
memory/4788-141-0x0000000002960000-0x0000000002996000-memory.dmpFilesize
216KB
-
memory/4804-172-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4804-174-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4804-168-0x0000000000000000-mapping.dmp