Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2022 10:09
Static task
static1
Behavioral task
behavioral1
Sample
INV90876.exe
Resource
win7-20220812-en
General
-
Target
INV90876.exe
-
Size
759KB
-
MD5
3b5e92e5880c828f9ad90929a3b6d5a1
-
SHA1
8282c9cb22644b515da8b049cd288cd09a891aee
-
SHA256
84530ed1bbd58c38b85fc93e447d14251cda335b3de5fe9216cf3386758cb0ee
-
SHA512
3a333d5e3d56a3e885ebbeda98f56da45782ade9c07ed8da3bee7f109f8bc90e4ee6dd7977705ac4854ef92915ee09ffdf716d40ecb07d5e8d2dfe8958dff449
Malware Config
Extracted
netwire
212.193.30.230:3345
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@9
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3672-146-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3672-148-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3672-152-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
INV90876.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation INV90876.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INV90876.exedescription pid process target process PID 4120 set thread context of 3672 4120 INV90876.exe INV90876.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1068 powershell.exe 1068 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1068 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
INV90876.exedescription pid process target process PID 4120 wrote to memory of 1068 4120 INV90876.exe powershell.exe PID 4120 wrote to memory of 1068 4120 INV90876.exe powershell.exe PID 4120 wrote to memory of 1068 4120 INV90876.exe powershell.exe PID 4120 wrote to memory of 3700 4120 INV90876.exe schtasks.exe PID 4120 wrote to memory of 3700 4120 INV90876.exe schtasks.exe PID 4120 wrote to memory of 3700 4120 INV90876.exe schtasks.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe PID 4120 wrote to memory of 3672 4120 INV90876.exe INV90876.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV90876.exe"C:\Users\Admin\AppData\Local\Temp\INV90876.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DHkCfBNYAPtx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DHkCfBNYAPtx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FC6.tmp"2⤵
- Creates scheduled task(s)
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\INV90876.exe"C:\Users\Admin\AppData\Local\Temp\INV90876.exe"2⤵PID:3672
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4FC6.tmpFilesize
1KB
MD5c329db2c05486040f904e2593e711cd6
SHA10e8be001238ffadfc99a38d10cfe570bbd447355
SHA256ad035d8ab76f941ef7d4dc2f55e9c710e3b9882593250ff0dd7772ec9df00eab
SHA5123a16aa64c45a121fb77d1252911047274707c55705dbbc893d9a83b7dae8152298440130f077e2c83319d3b90350733044b4ac1d8b9b133bf24019d2974a77f5
-
memory/1068-150-0x0000000004F20000-0x0000000004F86000-memory.dmpFilesize
408KB
-
memory/1068-156-0x00000000061C0000-0x00000000061DE000-memory.dmpFilesize
120KB
-
memory/1068-149-0x0000000004C80000-0x0000000004CA2000-memory.dmpFilesize
136KB
-
memory/1068-162-0x0000000007280000-0x000000000729A000-memory.dmpFilesize
104KB
-
memory/1068-140-0x0000000000000000-mapping.dmp
-
memory/1068-161-0x0000000007170000-0x000000000717E000-memory.dmpFilesize
56KB
-
memory/1068-142-0x0000000002300000-0x0000000002336000-memory.dmpFilesize
216KB
-
memory/1068-160-0x00000000071C0000-0x0000000007256000-memory.dmpFilesize
600KB
-
memory/1068-144-0x0000000005020000-0x0000000005648000-memory.dmpFilesize
6.2MB
-
memory/1068-159-0x0000000006FB0000-0x0000000006FBA000-memory.dmpFilesize
40KB
-
memory/1068-151-0x0000000005650000-0x00000000056B6000-memory.dmpFilesize
408KB
-
memory/1068-157-0x0000000007580000-0x0000000007BFA000-memory.dmpFilesize
6.5MB
-
memory/1068-155-0x0000000070840000-0x000000007088C000-memory.dmpFilesize
304KB
-
memory/1068-163-0x0000000007260000-0x0000000007268000-memory.dmpFilesize
32KB
-
memory/1068-158-0x0000000006F40000-0x0000000006F5A000-memory.dmpFilesize
104KB
-
memory/1068-154-0x00000000061E0000-0x0000000006212000-memory.dmpFilesize
200KB
-
memory/1068-153-0x0000000005C30000-0x0000000005C4E000-memory.dmpFilesize
120KB
-
memory/3672-152-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3672-148-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3672-146-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3672-145-0x0000000000000000-mapping.dmp
-
memory/3700-141-0x0000000000000000-mapping.dmp
-
memory/4120-138-0x0000000005320000-0x000000000532A000-memory.dmpFilesize
40KB
-
memory/4120-137-0x0000000005270000-0x0000000005302000-memory.dmpFilesize
584KB
-
memory/4120-136-0x0000000005720000-0x0000000005CC4000-memory.dmpFilesize
5.6MB
-
memory/4120-139-0x000000000B450000-0x000000000B4EC000-memory.dmpFilesize
624KB
-
memory/4120-135-0x0000000000800000-0x00000000008C2000-memory.dmpFilesize
776KB