Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2022 21:28
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA-027783278873287.exe
Resource
win7-20220718-en
General
-
Target
FACTURA-027783278873287.exe
-
Size
1.3MB
-
MD5
35711d2a8e8e96e025f54b5ca77db5f5
-
SHA1
4e3776b5db886079b003c28bec7656c5882d6fd0
-
SHA256
00c21d0a93a75ed3a206befabace5574014f5ea5dfbd314e46e3720d82c7a2e6
-
SHA512
917e3d4bf94133828375d69cfa21557405452fa28ddf5d874635867526eb670b4308815a81124d6ebdb5640c1890c48f22d4ee46ec0180af3310241dfbfcc862
Malware Config
Extracted
netwire
xman2.duckdns.org:4433
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1968-143-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/1968-145-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/1968-146-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/1968-147-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/1968-159-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/1968-161-0x0000000000400000-0x0000000000450000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FACTURA-027783278873287.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation FACTURA-027783278873287.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FACTURA-027783278873287.exedescription pid process target process PID 4940 set thread context of 1968 4940 FACTURA-027783278873287.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
FACTURA-027783278873287.exepowershell.exepid process 4940 FACTURA-027783278873287.exe 4940 FACTURA-027783278873287.exe 4940 FACTURA-027783278873287.exe 4940 FACTURA-027783278873287.exe 4940 FACTURA-027783278873287.exe 4940 FACTURA-027783278873287.exe 3588 powershell.exe 4940 FACTURA-027783278873287.exe 3588 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
FACTURA-027783278873287.exepowershell.exedescription pid process Token: SeDebugPrivilege 4940 FACTURA-027783278873287.exe Token: SeDebugPrivilege 3588 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
FACTURA-027783278873287.exevbc.execmd.exedescription pid process target process PID 4940 wrote to memory of 3588 4940 FACTURA-027783278873287.exe powershell.exe PID 4940 wrote to memory of 3588 4940 FACTURA-027783278873287.exe powershell.exe PID 4940 wrote to memory of 3588 4940 FACTURA-027783278873287.exe powershell.exe PID 4940 wrote to memory of 4644 4940 FACTURA-027783278873287.exe schtasks.exe PID 4940 wrote to memory of 4644 4940 FACTURA-027783278873287.exe schtasks.exe PID 4940 wrote to memory of 4644 4940 FACTURA-027783278873287.exe schtasks.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 4940 wrote to memory of 1968 4940 FACTURA-027783278873287.exe vbc.exe PID 1968 wrote to memory of 4476 1968 vbc.exe cmd.exe PID 1968 wrote to memory of 4476 1968 vbc.exe cmd.exe PID 1968 wrote to memory of 4476 1968 vbc.exe cmd.exe PID 4476 wrote to memory of 1596 4476 cmd.exe PING.EXE PID 4476 wrote to memory of 1596 4476 cmd.exe PING.EXE PID 4476 wrote to memory of 1596 4476 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\FACTURA-027783278873287.exe"C:\Users\Admin\AppData\Local\Temp\FACTURA-027783278873287.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DFwGjXjjmkAS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DFwGjXjjmkAS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAFE7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30004⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAFE7.tmpFilesize
1KB
MD59d1c6d25b092ba005f09734e1de6c0fe
SHA1884118748db375be4103c4df57632ceeb710987d
SHA2561f48ca79b8ea8ecbd96500407d11fed1a33ce084d9cac168ff24e22bc9797520
SHA512fc5b7d8073119e68fb175916f16609c50293acdaa8b42a4f553239f221511fc3372c3fb66d980c0101d9b3c7a36ba993701fe367b77b97228314df4a2d3f1707
-
memory/1596-162-0x0000000000000000-mapping.dmp
-
memory/1968-161-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1968-159-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1968-147-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1968-146-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1968-145-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1968-143-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1968-141-0x0000000000000000-mapping.dmp
-
memory/3588-138-0x0000000005180000-0x00000000051B6000-memory.dmpFilesize
216KB
-
memory/3588-150-0x00000000715C0000-0x000000007160C000-memory.dmpFilesize
304KB
-
memory/3588-158-0x0000000007D90000-0x0000000007D98000-memory.dmpFilesize
32KB
-
memory/3588-142-0x00000000057A0000-0x00000000057C2000-memory.dmpFilesize
136KB
-
memory/3588-157-0x0000000007DB0000-0x0000000007DCA000-memory.dmpFilesize
104KB
-
memory/3588-144-0x0000000005FD0000-0x0000000006036000-memory.dmpFilesize
408KB
-
memory/3588-136-0x0000000000000000-mapping.dmp
-
memory/3588-156-0x0000000007CA0000-0x0000000007CAE000-memory.dmpFilesize
56KB
-
memory/3588-155-0x0000000007CF0000-0x0000000007D86000-memory.dmpFilesize
600KB
-
memory/3588-148-0x0000000006760000-0x000000000677E000-memory.dmpFilesize
120KB
-
memory/3588-149-0x0000000006D30000-0x0000000006D62000-memory.dmpFilesize
200KB
-
memory/3588-140-0x0000000005830000-0x0000000005E58000-memory.dmpFilesize
6.2MB
-
memory/3588-151-0x0000000006D10000-0x0000000006D2E000-memory.dmpFilesize
120KB
-
memory/3588-152-0x00000000080B0000-0x000000000872A000-memory.dmpFilesize
6.5MB
-
memory/3588-153-0x0000000007A70000-0x0000000007A8A000-memory.dmpFilesize
104KB
-
memory/3588-154-0x0000000007AE0000-0x0000000007AEA000-memory.dmpFilesize
40KB
-
memory/4476-160-0x0000000000000000-mapping.dmp
-
memory/4644-137-0x0000000000000000-mapping.dmp
-
memory/4940-134-0x000000000BE50000-0x000000000BEEC000-memory.dmpFilesize
624KB
-
memory/4940-135-0x000000000C120000-0x000000000C186000-memory.dmpFilesize
408KB
-
memory/4940-130-0x0000000000F70000-0x00000000010B6000-memory.dmpFilesize
1.3MB
-
memory/4940-133-0x0000000005E10000-0x0000000005E1A000-memory.dmpFilesize
40KB
-
memory/4940-132-0x0000000005990000-0x0000000005A22000-memory.dmpFilesize
584KB
-
memory/4940-131-0x0000000006030000-0x00000000065D4000-memory.dmpFilesize
5.6MB