Analysis
-
max time kernel
123s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-08-2022 11:44
Static task
static1
Behavioral task
behavioral1
Sample
INV90876.exe
Resource
win7-20220812-en
General
-
Target
INV90876.exe
-
Size
759KB
-
MD5
3b5e92e5880c828f9ad90929a3b6d5a1
-
SHA1
8282c9cb22644b515da8b049cd288cd09a891aee
-
SHA256
84530ed1bbd58c38b85fc93e447d14251cda335b3de5fe9216cf3386758cb0ee
-
SHA512
3a333d5e3d56a3e885ebbeda98f56da45782ade9c07ed8da3bee7f109f8bc90e4ee6dd7977705ac4854ef92915ee09ffdf716d40ecb07d5e8d2dfe8958dff449
Malware Config
Extracted
netwire
212.193.30.230:3345
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@9
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1068-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1068-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1068-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1068-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1068-75-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1068-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1068-78-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1068-80-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INV90876.exedescription pid process target process PID 1848 set thread context of 1068 1848 INV90876.exe INV90876.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1304 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1304 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
INV90876.exedescription pid process target process PID 1848 wrote to memory of 1304 1848 INV90876.exe powershell.exe PID 1848 wrote to memory of 1304 1848 INV90876.exe powershell.exe PID 1848 wrote to memory of 1304 1848 INV90876.exe powershell.exe PID 1848 wrote to memory of 1304 1848 INV90876.exe powershell.exe PID 1848 wrote to memory of 1720 1848 INV90876.exe schtasks.exe PID 1848 wrote to memory of 1720 1848 INV90876.exe schtasks.exe PID 1848 wrote to memory of 1720 1848 INV90876.exe schtasks.exe PID 1848 wrote to memory of 1720 1848 INV90876.exe schtasks.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe PID 1848 wrote to memory of 1068 1848 INV90876.exe INV90876.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV90876.exe"C:\Users\Admin\AppData\Local\Temp\INV90876.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DHkCfBNYAPtx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DHkCfBNYAPtx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA35.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\INV90876.exe"C:\Users\Admin\AppData\Local\Temp\INV90876.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAA35.tmpFilesize
1KB
MD5ea3fe0b2947268e08443a606b743500f
SHA140eeb5fb38994504408e97f7d50e0672856a71dc
SHA256a9942bb8ea16e5877568e3e0041fefbfdcde0502b5880b430ef3667483706aee
SHA5120a68f915e478c203bc3fdd324fef1f077ca746cbcd3cc992da9186fb3268edeeb28d14d89300743f3c1d08dad571b6a7ba2b7f1274038f636a6d0655260ebe04
-
memory/1068-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1068-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1068-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1068-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1068-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1068-75-0x000000000040242D-mapping.dmp
-
memory/1068-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1068-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1068-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1068-78-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1068-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1304-59-0x0000000000000000-mapping.dmp
-
memory/1304-79-0x000000006E9A0000-0x000000006EF4B000-memory.dmpFilesize
5.7MB
-
memory/1720-60-0x0000000000000000-mapping.dmp
-
memory/1848-63-0x00000000021B0000-0x00000000021E4000-memory.dmpFilesize
208KB
-
memory/1848-55-0x0000000076091000-0x0000000076093000-memory.dmpFilesize
8KB
-
memory/1848-56-0x0000000000790000-0x00000000007AA000-memory.dmpFilesize
104KB
-
memory/1848-54-0x0000000000C70000-0x0000000000D32000-memory.dmpFilesize
776KB
-
memory/1848-58-0x0000000005B10000-0x0000000005B88000-memory.dmpFilesize
480KB
-
memory/1848-57-0x0000000000530000-0x000000000053C000-memory.dmpFilesize
48KB