Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-08-2022 16:54
Static task
static1
Behavioral task
behavioral1
Sample
INV90876.exe
Resource
win7-20220812-en
General
-
Target
INV90876.exe
-
Size
759KB
-
MD5
3b5e92e5880c828f9ad90929a3b6d5a1
-
SHA1
8282c9cb22644b515da8b049cd288cd09a891aee
-
SHA256
84530ed1bbd58c38b85fc93e447d14251cda335b3de5fe9216cf3386758cb0ee
-
SHA512
3a333d5e3d56a3e885ebbeda98f56da45782ade9c07ed8da3bee7f109f8bc90e4ee6dd7977705ac4854ef92915ee09ffdf716d40ecb07d5e8d2dfe8958dff449
Malware Config
Extracted
netwire
212.193.30.230:3345
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@9
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/660-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/660-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/660-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/660-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/660-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/660-75-0x000000000040242D-mapping.dmp netwire behavioral1/memory/660-78-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/660-80-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INV90876.exedescription pid process target process PID 1440 set thread context of 660 1440 INV90876.exe INV90876.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1520 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1520 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
INV90876.exedescription pid process target process PID 1440 wrote to memory of 1520 1440 INV90876.exe powershell.exe PID 1440 wrote to memory of 1520 1440 INV90876.exe powershell.exe PID 1440 wrote to memory of 1520 1440 INV90876.exe powershell.exe PID 1440 wrote to memory of 1520 1440 INV90876.exe powershell.exe PID 1440 wrote to memory of 1416 1440 INV90876.exe schtasks.exe PID 1440 wrote to memory of 1416 1440 INV90876.exe schtasks.exe PID 1440 wrote to memory of 1416 1440 INV90876.exe schtasks.exe PID 1440 wrote to memory of 1416 1440 INV90876.exe schtasks.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe PID 1440 wrote to memory of 660 1440 INV90876.exe INV90876.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV90876.exe"C:\Users\Admin\AppData\Local\Temp\INV90876.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DHkCfBNYAPtx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DHkCfBNYAPtx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCAC.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\INV90876.exe"C:\Users\Admin\AppData\Local\Temp\INV90876.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBCAC.tmpFilesize
1KB
MD50e95ae49b92d6edd6a1439ab2a5ccab5
SHA18ded2a376ca9a097a3b2d10db091c55abc3d6512
SHA25618c96ee6ce118e394aed2a79b731861f24789faeb8fd995224ecb8e704b7ea7e
SHA5127f8b75dd978ecf067774750d0bc28ac5175226144670f549439d1ef488847772da124149d08b1bb1221fbc224b3c0563b1c6fe87de43d2c2a83d32f2925fc91a
-
memory/660-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-78-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/660-75-0x000000000040242D-mapping.dmp
-
memory/660-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1416-60-0x0000000000000000-mapping.dmp
-
memory/1440-55-0x0000000075AF1000-0x0000000075AF3000-memory.dmpFilesize
8KB
-
memory/1440-58-0x0000000005BB0000-0x0000000005C28000-memory.dmpFilesize
480KB
-
memory/1440-54-0x0000000000B30000-0x0000000000BF2000-memory.dmpFilesize
776KB
-
memory/1440-57-0x00000000008F0000-0x00000000008FC000-memory.dmpFilesize
48KB
-
memory/1440-63-0x00000000042F0000-0x0000000004324000-memory.dmpFilesize
208KB
-
memory/1440-56-0x0000000000660000-0x000000000067A000-memory.dmpFilesize
104KB
-
memory/1520-59-0x0000000000000000-mapping.dmp
-
memory/1520-79-0x000000006EB20000-0x000000006F0CB000-memory.dmpFilesize
5.7MB
-
memory/1520-81-0x000000006EB20000-0x000000006F0CB000-memory.dmpFilesize
5.7MB