Analysis
-
max time kernel
125s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2022 18:03
Static task
static1
General
-
Target
024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe
-
Size
696KB
-
MD5
e40fb6f7b8378a9d0606cfac8eb60f5d
-
SHA1
b8da9767ceeec76d7b465db3ad098f740f97c35e
-
SHA256
024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
-
SHA512
9225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/3796-142-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/3796-144-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/3796-149-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1728-170-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1728-172-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 2756 Host.exe 1728 Host.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exeHost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exeHost.exedescription pid process target process PID 4676 set thread context of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 2756 set thread context of 1728 2756 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3052 schtasks.exe 2348 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exepowershell.exeHost.exepowershell.exepid process 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 2312 powershell.exe 2312 powershell.exe 2756 Host.exe 2756 Host.exe 4632 powershell.exe 4632 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exepowershell.exeHost.exepowershell.exedescription pid process Token: SeDebugPrivilege 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe Token: SeDebugPrivilege 2312 powershell.exe Token: SeDebugPrivilege 2756 Host.exe Token: SeDebugPrivilege 4632 powershell.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exeHost.exedescription pid process target process PID 4676 wrote to memory of 2312 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe powershell.exe PID 4676 wrote to memory of 2312 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe powershell.exe PID 4676 wrote to memory of 2312 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe powershell.exe PID 4676 wrote to memory of 3052 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe schtasks.exe PID 4676 wrote to memory of 3052 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe schtasks.exe PID 4676 wrote to memory of 3052 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe schtasks.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 4676 wrote to memory of 3796 4676 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe PID 3796 wrote to memory of 2756 3796 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe Host.exe PID 3796 wrote to memory of 2756 3796 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe Host.exe PID 3796 wrote to memory of 2756 3796 024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe Host.exe PID 2756 wrote to memory of 4632 2756 Host.exe powershell.exe PID 2756 wrote to memory of 4632 2756 Host.exe powershell.exe PID 2756 wrote to memory of 4632 2756 Host.exe powershell.exe PID 2756 wrote to memory of 2348 2756 Host.exe schtasks.exe PID 2756 wrote to memory of 2348 2756 Host.exe schtasks.exe PID 2756 wrote to memory of 2348 2756 Host.exe schtasks.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe PID 2756 wrote to memory of 1728 2756 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe"C:\Users\Admin\AppData\Local\Temp\024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QrFwdapUjOrhP.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QrFwdapUjOrhP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1685.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe"C:\Users\Admin\AppData\Local\Temp\024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QrFwdapUjOrhP.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QrFwdapUjOrhP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE3D8.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ffdf9d8e374043ac99d13874ff4d6dcf
SHA18ce6bab415ebbc4c0c45cff5b53befcebcd8e16c
SHA256c4b23fa21ceb2636bc7ebbdcbdaa057785c2fb7f8069a5297df3e2ddff883cb9
SHA512031d9389a5bb13c0bb84a909b68c03a08eddac14b4f79007f0a28d0c6533786c97f56ffbf03841d2713d1523d41630507cf993fb0139d324a588f5cd68bfa67a
-
C:\Users\Admin\AppData\Local\Temp\tmp1685.tmpFilesize
1KB
MD5db5f7fc1d6e2ae5a9919646eb3b4f05b
SHA1c1fee8780397d4baf161c4cda17dcd08ff6109b6
SHA25605044f08029f9f9ac667f278beeff2de08724095b72979afd461907c6e9e3a18
SHA512bb36edf14b9d9070173cc66f1f3992ec5f34e75519e1013361b1b8debf02d9875e36931bb4ac5a7c43d7ca0735b7d8841d1aa496f93aea0aa05411b5640ef632
-
C:\Users\Admin\AppData\Local\Temp\tmpE3D8.tmpFilesize
1KB
MD5db5f7fc1d6e2ae5a9919646eb3b4f05b
SHA1c1fee8780397d4baf161c4cda17dcd08ff6109b6
SHA25605044f08029f9f9ac667f278beeff2de08724095b72979afd461907c6e9e3a18
SHA512bb36edf14b9d9070173cc66f1f3992ec5f34e75519e1013361b1b8debf02d9875e36931bb4ac5a7c43d7ca0735b7d8841d1aa496f93aea0aa05411b5640ef632
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
memory/1728-172-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1728-170-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1728-166-0x0000000000000000-mapping.dmp
-
memory/2312-151-0x0000000005DF0000-0x0000000005E0E000-memory.dmpFilesize
120KB
-
memory/2312-156-0x00000000070F0000-0x000000000710A000-memory.dmpFilesize
104KB
-
memory/2312-136-0x0000000000000000-mapping.dmp
-
memory/2312-161-0x0000000007420000-0x0000000007428000-memory.dmpFilesize
32KB
-
memory/2312-145-0x0000000004D20000-0x0000000004D42000-memory.dmpFilesize
136KB
-
memory/2312-160-0x0000000007440000-0x000000000745A000-memory.dmpFilesize
104KB
-
memory/2312-159-0x0000000007330000-0x000000000733E000-memory.dmpFilesize
56KB
-
memory/2312-140-0x0000000005070000-0x0000000005698000-memory.dmpFilesize
6.2MB
-
memory/2312-146-0x0000000004DC0000-0x0000000004E26000-memory.dmpFilesize
408KB
-
memory/2312-138-0x00000000024C0000-0x00000000024F6000-memory.dmpFilesize
216KB
-
memory/2312-158-0x0000000007380000-0x0000000007416000-memory.dmpFilesize
600KB
-
memory/2312-152-0x00000000063B0000-0x00000000063E2000-memory.dmpFilesize
200KB
-
memory/2312-153-0x0000000071260000-0x00000000712AC000-memory.dmpFilesize
304KB
-
memory/2312-154-0x0000000006390000-0x00000000063AE000-memory.dmpFilesize
120KB
-
memory/2312-155-0x0000000007730000-0x0000000007DAA000-memory.dmpFilesize
6.5MB
-
memory/2312-157-0x0000000007160000-0x000000000716A000-memory.dmpFilesize
40KB
-
memory/2348-163-0x0000000000000000-mapping.dmp
-
memory/2756-147-0x0000000000000000-mapping.dmp
-
memory/3052-137-0x0000000000000000-mapping.dmp
-
memory/3796-141-0x0000000000000000-mapping.dmp
-
memory/3796-144-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3796-149-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3796-142-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4632-162-0x0000000000000000-mapping.dmp
-
memory/4632-173-0x0000000072140000-0x000000007218C000-memory.dmpFilesize
304KB
-
memory/4676-130-0x0000000000160000-0x0000000000214000-memory.dmpFilesize
720KB
-
memory/4676-135-0x000000000B020000-0x000000000B086000-memory.dmpFilesize
408KB
-
memory/4676-134-0x0000000008520000-0x00000000085BC000-memory.dmpFilesize
624KB
-
memory/4676-133-0x0000000004BD0000-0x0000000004BDA000-memory.dmpFilesize
40KB
-
memory/4676-132-0x0000000004C40000-0x0000000004CD2000-memory.dmpFilesize
584KB
-
memory/4676-131-0x0000000005150000-0x00000000056F4000-memory.dmpFilesize
5.6MB