Analysis
-
max time kernel
64s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
04-08-2022 21:31
Static task
static1
Behavioral task
behavioral1
Sample
INV03483287732.exe
Resource
win7-20220715-en
General
-
Target
INV03483287732.exe
-
Size
782KB
-
MD5
2fe9032113e6cad33dee260c180cf758
-
SHA1
db6b2f0bc2936400b3b1c8c118a77d0ba4e61c57
-
SHA256
171c720d3c447b5011c0de2a4669df9406bcf4ba7581c7e8582f4ad526bb43b2
-
SHA512
70245873ee8fca013357437af10bd6a2a34cf094bb46a34466b91743943ab3ea4b561100a6768bec684f1a0f30f0e4ed9b643b4f8728da69141df7e886f86cde
Malware Config
Extracted
netwire
149.102.132.253:3399
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/656-69-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/656-71-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/656-72-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/656-74-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/656-75-0x000000000041AE7B-mapping.dmp netwire behavioral1/memory/656-78-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/656-80-0x0000000000400000-0x0000000000450000-memory.dmp netwire -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
INV03483287732.exedescription pid process target process PID 1976 set thread context of 656 1976 INV03483287732.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
INV03483287732.exepowershell.exepid process 1976 INV03483287732.exe 1976 INV03483287732.exe 1976 INV03483287732.exe 1976 INV03483287732.exe 1976 INV03483287732.exe 1976 INV03483287732.exe 1732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
INV03483287732.exepowershell.exedescription pid process Token: SeDebugPrivilege 1976 INV03483287732.exe Token: SeDebugPrivilege 1732 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
INV03483287732.exedescription pid process target process PID 1976 wrote to memory of 1732 1976 INV03483287732.exe powershell.exe PID 1976 wrote to memory of 1732 1976 INV03483287732.exe powershell.exe PID 1976 wrote to memory of 1732 1976 INV03483287732.exe powershell.exe PID 1976 wrote to memory of 1732 1976 INV03483287732.exe powershell.exe PID 1976 wrote to memory of 1536 1976 INV03483287732.exe schtasks.exe PID 1976 wrote to memory of 1536 1976 INV03483287732.exe schtasks.exe PID 1976 wrote to memory of 1536 1976 INV03483287732.exe schtasks.exe PID 1976 wrote to memory of 1536 1976 INV03483287732.exe schtasks.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe PID 1976 wrote to memory of 656 1976 INV03483287732.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV03483287732.exe"C:\Users\Admin\AppData\Local\Temp\INV03483287732.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xefxVoegFLrT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xefxVoegFLrT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF6FD.tmpFilesize
1KB
MD5cef89ce4eb61662380f2c61ab6bb3e28
SHA1c21dac92d764050c3da250c646f8ad3534137e4a
SHA256479aff0caea3d6d71cbdd2b5fa2d5c82634970973d121eeac25f056c514b5439
SHA5122e4ca98edde17615957e906051d4722cd01e15d4c1ddb278c4cb814a21650838c5b0c4ed2078b94628e70b624b0ca536d7d3337d0d27546744cedbc1bc194003
-
memory/656-74-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/656-69-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/656-64-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/656-80-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/656-65-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/656-78-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/656-75-0x000000000041AE7B-mapping.dmp
-
memory/656-67-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/656-72-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/656-71-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1536-60-0x0000000000000000-mapping.dmp
-
memory/1732-79-0x000000006EAC0000-0x000000006F06B000-memory.dmpFilesize
5.7MB
-
memory/1732-81-0x000000006EAC0000-0x000000006F06B000-memory.dmpFilesize
5.7MB
-
memory/1732-59-0x0000000000000000-mapping.dmp
-
memory/1976-63-0x0000000005E30000-0x0000000005E7E000-memory.dmpFilesize
312KB
-
memory/1976-54-0x0000000001250000-0x0000000001318000-memory.dmpFilesize
800KB
-
memory/1976-55-0x0000000076901000-0x0000000076903000-memory.dmpFilesize
8KB
-
memory/1976-56-0x0000000000530000-0x0000000000546000-memory.dmpFilesize
88KB
-
memory/1976-58-0x0000000005C90000-0x0000000005D28000-memory.dmpFilesize
608KB
-
memory/1976-57-0x00000000005D0000-0x00000000005DA000-memory.dmpFilesize
40KB