Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
05-08-2022 08:35
Static task
static1
Behavioral task
behavioral1
Sample
RECHNUNG-RP0188843894.exe
Resource
win7-20220718-en
General
-
Target
RECHNUNG-RP0188843894.exe
-
Size
1.2MB
-
MD5
e366f96c9b5c5528426a116eb49ef445
-
SHA1
8062220b613b56116d638b3d7f5dd043f3bc096e
-
SHA256
2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58
-
SHA512
1dc21da10c45a5fbd5058e85d775cccec140a0fec067183013457d7ab87f9bfd758429a999df2b2bf0afd19d44b289418c6a8457689346521764a812a0430e9d
Malware Config
Extracted
netwire
xman2.duckdns.org:4433
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/572-69-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/572-72-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/572-71-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/572-74-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/572-75-0x000000000041AE7B-mapping.dmp netwire behavioral1/memory/572-78-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral1/memory/572-80-0x0000000000400000-0x0000000000450000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RECHNUNG-RP0188843894.exedescription pid process target process PID 1420 set thread context of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
RECHNUNG-RP0188843894.exepowershell.exepid process 1420 RECHNUNG-RP0188843894.exe 1420 RECHNUNG-RP0188843894.exe 1420 RECHNUNG-RP0188843894.exe 1420 RECHNUNG-RP0188843894.exe 1420 RECHNUNG-RP0188843894.exe 1420 RECHNUNG-RP0188843894.exe 1420 RECHNUNG-RP0188843894.exe 1420 RECHNUNG-RP0188843894.exe 1160 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RECHNUNG-RP0188843894.exepowershell.exedescription pid process Token: SeDebugPrivilege 1420 RECHNUNG-RP0188843894.exe Token: SeDebugPrivilege 1160 powershell.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
RECHNUNG-RP0188843894.exedescription pid process target process PID 1420 wrote to memory of 1160 1420 RECHNUNG-RP0188843894.exe powershell.exe PID 1420 wrote to memory of 1160 1420 RECHNUNG-RP0188843894.exe powershell.exe PID 1420 wrote to memory of 1160 1420 RECHNUNG-RP0188843894.exe powershell.exe PID 1420 wrote to memory of 1160 1420 RECHNUNG-RP0188843894.exe powershell.exe PID 1420 wrote to memory of 1116 1420 RECHNUNG-RP0188843894.exe schtasks.exe PID 1420 wrote to memory of 1116 1420 RECHNUNG-RP0188843894.exe schtasks.exe PID 1420 wrote to memory of 1116 1420 RECHNUNG-RP0188843894.exe schtasks.exe PID 1420 wrote to memory of 1116 1420 RECHNUNG-RP0188843894.exe schtasks.exe PID 1420 wrote to memory of 1928 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 1928 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 1928 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 1928 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe PID 1420 wrote to memory of 572 1420 RECHNUNG-RP0188843894.exe RECHNUNG-RP0188843894.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RECHNUNG-RP0188843894.exe"C:\Users\Admin\AppData\Local\Temp\RECHNUNG-RP0188843894.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rWWREmAZOgElhb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rWWREmAZOgElhb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD53A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RECHNUNG-RP0188843894.exe"C:\Users\Admin\AppData\Local\Temp\RECHNUNG-RP0188843894.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RECHNUNG-RP0188843894.exe"C:\Users\Admin\AppData\Local\Temp\RECHNUNG-RP0188843894.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD53A.tmpFilesize
1KB
MD5e13a1d0a20fdcf79d403d4bf43fc39ff
SHA153daf0ad7bf3558a7f420b084da2b1fb394f97e1
SHA2569fb5c8b25bcc6ecd399a034f7c8715602b582bcc9d7ba5ce2396a231662a8cf7
SHA51251b466136efaee10082e3920d07bd85f7992df799b82a46cfcc48a1fb3cb436afb32f91d9d626f92f81b6f2801642fa9906c669eb442488d0f82238cb862451b
-
memory/572-74-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/572-72-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/572-64-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/572-80-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/572-67-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/572-78-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/572-75-0x000000000041AE7B-mapping.dmp
-
memory/572-69-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/572-65-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/572-71-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1116-60-0x0000000000000000-mapping.dmp
-
memory/1160-79-0x000000006BED0000-0x000000006C47B000-memory.dmpFilesize
5.7MB
-
memory/1160-81-0x000000006BED0000-0x000000006C47B000-memory.dmpFilesize
5.7MB
-
memory/1160-59-0x0000000000000000-mapping.dmp
-
memory/1420-63-0x0000000004E90000-0x0000000004EDC000-memory.dmpFilesize
304KB
-
memory/1420-54-0x0000000001340000-0x0000000001484000-memory.dmpFilesize
1.3MB
-
memory/1420-55-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/1420-56-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/1420-58-0x000000000A4C0000-0x000000000A558000-memory.dmpFilesize
608KB
-
memory/1420-57-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB