Analysis
-
max time kernel
141s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2022 13:14
Static task
static1
Behavioral task
behavioral1
Sample
97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe
Resource
win7-20220718-en
General
-
Target
97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe
-
Size
555KB
-
MD5
144864cb064cd008df905e94239641a7
-
SHA1
7da2c3a83db7624d84ddf78d98e684dcbae12172
-
SHA256
97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3
-
SHA512
18085befbedd34d9db3473b34895ebfbca94e34a76d66365eea9e1341c1441d1f2e474f9ef6e6425b5bbf193327b1e2b9235ef435d285d429f2406c7ee623c55
Malware Config
Extracted
netwire
185.140.53.61:3363
185.140.53.61:3365
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
move4ward
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4644-140-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4644-142-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4644-143-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4644-144-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exedescription pid process target process PID 3344 set thread context of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exepid process 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exedescription pid process Token: SeDebugPrivilege 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exedescription pid process target process PID 3344 wrote to memory of 3048 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe schtasks.exe PID 3344 wrote to memory of 3048 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe schtasks.exe PID 3344 wrote to memory of 3048 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe schtasks.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe PID 3344 wrote to memory of 4644 3344 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe 97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe"C:\Users\Admin\AppData\Local\Temp\97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HtsxZECQaAEQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE261.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\97aade816a21c7063ea9872443acf770fc2d06a02badb1537a4a071dde9feda3.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE261.tmpFilesize
1KB
MD5548dc02e1f0c038c050e72df9adece06
SHA1bc1a02537c6ec5571789aed0dc0e3e3327c2b797
SHA2561c32ca1fdef19a9c109be14967ae472cbf8be066ffc1a7c198d79503dc34462a
SHA51256f32bc4eac58330164e7a2e6dfdccc5daea8611a5a1886f2d4efc0f2fb036acba91ddd6d798131e4fff60c68d60e5fcba81531e4a88830810547d049ab02113
-
memory/3048-137-0x0000000000000000-mapping.dmp
-
memory/3344-132-0x00000000001B0000-0x0000000000240000-memory.dmpFilesize
576KB
-
memory/3344-133-0x0000000005490000-0x0000000005A34000-memory.dmpFilesize
5.6MB
-
memory/3344-134-0x0000000004FE0000-0x0000000005072000-memory.dmpFilesize
584KB
-
memory/3344-135-0x0000000005080000-0x000000000511C000-memory.dmpFilesize
624KB
-
memory/3344-136-0x0000000004C50000-0x0000000004C5A000-memory.dmpFilesize
40KB
-
memory/4644-139-0x0000000000000000-mapping.dmp
-
memory/4644-140-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4644-142-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4644-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4644-144-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB