Analysis
-
max time kernel
74s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2022 09:01
Static task
static1
Behavioral task
behavioral1
Sample
IM202208.exe
Resource
win7-20220812-en
General
-
Target
IM202208.exe
-
Size
727KB
-
MD5
c1ca174fbfc7936f8d9d0aad755f29cf
-
SHA1
16ad7f314c9c2742886523ac256fbb4a5f4bfdb0
-
SHA256
d08f75542680080f9d3393fc3bb0ced3c30335db5030c1f38a8d7a7aadb15794
-
SHA512
e2ff294837639043c1b24cfee2eae281284ac9a563ad5e8d31a8ce7538f60447cb747508021b98326a78923e99159109fc908c390a8f3d570d7d91b6d24fa280
Malware Config
Extracted
netwire
212.193.30.230:3363
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@2
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3676-143-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3676-145-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3676-149-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IM202208.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation IM202208.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
IM202208.exedescription pid process target process PID 3356 set thread context of 3676 3356 IM202208.exe IM202208.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 208 powershell.exe 208 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 208 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
IM202208.exedescription pid process target process PID 3356 wrote to memory of 208 3356 IM202208.exe powershell.exe PID 3356 wrote to memory of 208 3356 IM202208.exe powershell.exe PID 3356 wrote to memory of 208 3356 IM202208.exe powershell.exe PID 3356 wrote to memory of 204 3356 IM202208.exe schtasks.exe PID 3356 wrote to memory of 204 3356 IM202208.exe schtasks.exe PID 3356 wrote to memory of 204 3356 IM202208.exe schtasks.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe PID 3356 wrote to memory of 3676 3356 IM202208.exe IM202208.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IM202208.exe"C:\Users\Admin\AppData\Local\Temp\IM202208.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uunNVGIyv.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uunNVGIyv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5C2A.tmp"2⤵
- Creates scheduled task(s)
PID:204 -
C:\Users\Admin\AppData\Local\Temp\IM202208.exe"C:\Users\Admin\AppData\Local\Temp\IM202208.exe"2⤵PID:3676
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5C2A.tmpFilesize
1KB
MD579a54267f4a057b2490786bb5321309f
SHA18374e688ddf0dbb85e071ee037183b4e851ecf36
SHA2566ef3a47acbd25dc291fe1920176cfdfd68f9865153e9a6a7dcb5f74ff3313157
SHA512f17cc4a8d58fdffc5f2c0480bd9052115d28c5b919a4f4f92f8abb5683c96b8073b420eafefa43d303bd31e56e335ed46ab133a1a3cf805df07cb7d1ca1f44e4
-
memory/204-138-0x0000000000000000-mapping.dmp
-
memory/208-147-0x0000000005C30000-0x0000000005C96000-memory.dmpFilesize
408KB
-
memory/208-154-0x0000000007C30000-0x00000000082AA000-memory.dmpFilesize
6.5MB
-
memory/208-148-0x0000000005CA0000-0x0000000005D06000-memory.dmpFilesize
408KB
-
memory/208-159-0x0000000007920000-0x000000000793A000-memory.dmpFilesize
104KB
-
memory/208-158-0x0000000007810000-0x000000000781E000-memory.dmpFilesize
56KB
-
memory/208-139-0x0000000004D00000-0x0000000004D36000-memory.dmpFilesize
216KB
-
memory/208-157-0x0000000007860000-0x00000000078F6000-memory.dmpFilesize
600KB
-
memory/208-142-0x0000000005480000-0x0000000005AA8000-memory.dmpFilesize
6.2MB
-
memory/208-156-0x0000000007650000-0x000000000765A000-memory.dmpFilesize
40KB
-
memory/208-155-0x00000000075E0000-0x00000000075FA000-memory.dmpFilesize
104KB
-
memory/208-153-0x0000000006880000-0x000000000689E000-memory.dmpFilesize
120KB
-
memory/208-146-0x0000000005420000-0x0000000005442000-memory.dmpFilesize
136KB
-
memory/208-160-0x0000000007900000-0x0000000007908000-memory.dmpFilesize
32KB
-
memory/208-152-0x0000000070BC0000-0x0000000070C0C000-memory.dmpFilesize
304KB
-
memory/208-137-0x0000000000000000-mapping.dmp
-
memory/208-150-0x00000000062E0000-0x00000000062FE000-memory.dmpFilesize
120KB
-
memory/208-151-0x00000000068A0000-0x00000000068D2000-memory.dmpFilesize
200KB
-
memory/3356-136-0x000000000B0B0000-0x000000000B14C000-memory.dmpFilesize
624KB
-
memory/3356-135-0x0000000005140000-0x000000000514A000-memory.dmpFilesize
40KB
-
memory/3356-133-0x0000000005780000-0x0000000005D24000-memory.dmpFilesize
5.6MB
-
memory/3356-134-0x00000000051D0000-0x0000000005262000-memory.dmpFilesize
584KB
-
memory/3356-132-0x00000000006F0000-0x00000000007AC000-memory.dmpFilesize
752KB
-
memory/3676-145-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3676-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3676-141-0x0000000000000000-mapping.dmp
-
memory/3676-149-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB