Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2022 16:54
Static task
static1
Behavioral task
behavioral1
Sample
INV90876.exe
Resource
win7-20220812-en
General
-
Target
INV90876.exe
-
Size
759KB
-
MD5
3b5e92e5880c828f9ad90929a3b6d5a1
-
SHA1
8282c9cb22644b515da8b049cd288cd09a891aee
-
SHA256
84530ed1bbd58c38b85fc93e447d14251cda335b3de5fe9216cf3386758cb0ee
-
SHA512
3a333d5e3d56a3e885ebbeda98f56da45782ade9c07ed8da3bee7f109f8bc90e4ee6dd7977705ac4854ef92915ee09ffdf716d40ecb07d5e8d2dfe8958dff449
Malware Config
Extracted
netwire
212.193.30.230:3345
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@9
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/536-144-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/536-146-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/536-150-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
INV90876.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation INV90876.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INV90876.exedescription pid process target process PID 628 set thread context of 536 628 INV90876.exe INV90876.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
INV90876.exepowershell.exepid process 628 INV90876.exe 628 INV90876.exe 4312 powershell.exe 4312 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
INV90876.exepowershell.exedescription pid process Token: SeDebugPrivilege 628 INV90876.exe Token: SeDebugPrivilege 4312 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
INV90876.exedescription pid process target process PID 628 wrote to memory of 4312 628 INV90876.exe powershell.exe PID 628 wrote to memory of 4312 628 INV90876.exe powershell.exe PID 628 wrote to memory of 4312 628 INV90876.exe powershell.exe PID 628 wrote to memory of 1936 628 INV90876.exe schtasks.exe PID 628 wrote to memory of 1936 628 INV90876.exe schtasks.exe PID 628 wrote to memory of 1936 628 INV90876.exe schtasks.exe PID 628 wrote to memory of 1440 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 1440 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 1440 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe PID 628 wrote to memory of 536 628 INV90876.exe INV90876.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV90876.exe"C:\Users\Admin\AppData\Local\Temp\INV90876.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DHkCfBNYAPtx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DHkCfBNYAPtx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4277.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\INV90876.exe"C:\Users\Admin\AppData\Local\Temp\INV90876.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\INV90876.exe"C:\Users\Admin\AppData\Local\Temp\INV90876.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4277.tmpFilesize
1KB
MD5bdad4564248dac715c53f5dde8491f42
SHA1c2ad80240ccb5007fb03534b580096406ce1bc9f
SHA25662e3bcd0860b9c1962f741bb9aa24ecbb0b8fe79ebbc926c0e06bd6e71d2b9d8
SHA51236d9aade4b7957c3cdca39df767bb55a8b71a04f24cf8bc1af1f22ad9a41411c669c96d221457da4847332a319221b8f4f6fa414788da157f5ae9ff37efcbaac
-
memory/536-143-0x0000000000000000-mapping.dmp
-
memory/536-150-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/536-146-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/536-144-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/628-133-0x00000000058C0000-0x0000000005E64000-memory.dmpFilesize
5.6MB
-
memory/628-134-0x00000000053B0000-0x0000000005442000-memory.dmpFilesize
584KB
-
memory/628-135-0x0000000005330000-0x000000000533A000-memory.dmpFilesize
40KB
-
memory/628-136-0x0000000007640000-0x00000000076DC000-memory.dmpFilesize
624KB
-
memory/628-132-0x00000000008B0000-0x0000000000972000-memory.dmpFilesize
776KB
-
memory/1440-141-0x0000000000000000-mapping.dmp
-
memory/1936-138-0x0000000000000000-mapping.dmp
-
memory/4312-147-0x00000000052E0000-0x0000000005302000-memory.dmpFilesize
136KB
-
memory/4312-154-0x00000000069D0000-0x00000000069EE000-memory.dmpFilesize
120KB
-
memory/4312-139-0x0000000004DF0000-0x0000000004E26000-memory.dmpFilesize
216KB
-
memory/4312-148-0x0000000005CE0000-0x0000000005D46000-memory.dmpFilesize
408KB
-
memory/4312-149-0x0000000005E00000-0x0000000005E66000-memory.dmpFilesize
408KB
-
memory/4312-137-0x0000000000000000-mapping.dmp
-
memory/4312-151-0x0000000006430000-0x000000000644E000-memory.dmpFilesize
120KB
-
memory/4312-152-0x00000000069F0000-0x0000000006A22000-memory.dmpFilesize
200KB
-
memory/4312-153-0x0000000070CB0000-0x0000000070CFC000-memory.dmpFilesize
304KB
-
memory/4312-142-0x0000000005540000-0x0000000005B68000-memory.dmpFilesize
6.2MB
-
memory/4312-155-0x0000000007D70000-0x00000000083EA000-memory.dmpFilesize
6.5MB
-
memory/4312-156-0x0000000007730000-0x000000000774A000-memory.dmpFilesize
104KB
-
memory/4312-157-0x00000000077A0000-0x00000000077AA000-memory.dmpFilesize
40KB
-
memory/4312-158-0x00000000079B0000-0x0000000007A46000-memory.dmpFilesize
600KB
-
memory/4312-159-0x0000000007960000-0x000000000796E000-memory.dmpFilesize
56KB
-
memory/4312-160-0x0000000007A70000-0x0000000007A8A000-memory.dmpFilesize
104KB
-
memory/4312-161-0x0000000007A50000-0x0000000007A58000-memory.dmpFilesize
32KB