Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2022 09:39
Static task
static1
Behavioral task
behavioral1
Sample
IM202208.exe
Resource
win7-20220812-en
General
-
Target
IM202208.exe
-
Size
727KB
-
MD5
c1ca174fbfc7936f8d9d0aad755f29cf
-
SHA1
16ad7f314c9c2742886523ac256fbb4a5f4bfdb0
-
SHA256
d08f75542680080f9d3393fc3bb0ced3c30335db5030c1f38a8d7a7aadb15794
-
SHA512
e2ff294837639043c1b24cfee2eae281284ac9a563ad5e8d31a8ce7538f60447cb747508021b98326a78923e99159109fc908c390a8f3d570d7d91b6d24fa280
Malware Config
Extracted
netwire
212.193.30.230:3363
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@2
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5048-143-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/5048-145-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/5048-147-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/5048-161-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IM202208.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation IM202208.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
IM202208.exedescription pid process target process PID 3608 set thread context of 5048 3608 IM202208.exe IM202208.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2920 powershell.exe 2920 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2920 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
IM202208.exedescription pid process target process PID 3608 wrote to memory of 2920 3608 IM202208.exe powershell.exe PID 3608 wrote to memory of 2920 3608 IM202208.exe powershell.exe PID 3608 wrote to memory of 2920 3608 IM202208.exe powershell.exe PID 3608 wrote to memory of 4156 3608 IM202208.exe schtasks.exe PID 3608 wrote to memory of 4156 3608 IM202208.exe schtasks.exe PID 3608 wrote to memory of 4156 3608 IM202208.exe schtasks.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe PID 3608 wrote to memory of 5048 3608 IM202208.exe IM202208.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IM202208.exe"C:\Users\Admin\AppData\Local\Temp\IM202208.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uunNVGIyv.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uunNVGIyv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDBAA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\IM202208.exe"C:\Users\Admin\AppData\Local\Temp\IM202208.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDBAA.tmpFilesize
1KB
MD5b8f23a7a163febfb4c89cf1ce80afd1e
SHA1e129099bce699781c173b9f14495f3c074ecaffb
SHA256d73654bc1ec2bc20b2900cb5da9ebce437132301c1a36f7a14d63ceb13177c35
SHA5128842cf8a9c43396e40cc584981b68f3fc972b79df5b089e0e0b36688aeadaead2acaab43d08df40b0e0759089dbe2949a7b3aee83ec4ba3c9c6afe11e4cdd99d
-
memory/2920-148-0x0000000005A30000-0x0000000005A96000-memory.dmpFilesize
408KB
-
memory/2920-153-0x0000000006EE0000-0x0000000006EFE000-memory.dmpFilesize
120KB
-
memory/2920-146-0x0000000005870000-0x0000000005892000-memory.dmpFilesize
136KB
-
memory/2920-160-0x0000000007F70000-0x0000000007F78000-memory.dmpFilesize
32KB
-
memory/2920-137-0x0000000000000000-mapping.dmp
-
memory/2920-158-0x0000000007E80000-0x0000000007E8E000-memory.dmpFilesize
56KB
-
memory/2920-139-0x0000000003030000-0x0000000003066000-memory.dmpFilesize
216KB
-
memory/2920-157-0x0000000007EC0000-0x0000000007F56000-memory.dmpFilesize
600KB
-
memory/2920-141-0x0000000005B50000-0x0000000006178000-memory.dmpFilesize
6.2MB
-
memory/2920-156-0x0000000007CB0000-0x0000000007CBA000-memory.dmpFilesize
40KB
-
memory/2920-155-0x0000000007C40000-0x0000000007C5A000-memory.dmpFilesize
104KB
-
memory/2920-154-0x0000000008290000-0x000000000890A000-memory.dmpFilesize
6.5MB
-
memory/2920-149-0x00000000062F0000-0x0000000006356000-memory.dmpFilesize
408KB
-
memory/2920-159-0x0000000007F90000-0x0000000007FAA000-memory.dmpFilesize
104KB
-
memory/2920-152-0x0000000071660000-0x00000000716AC000-memory.dmpFilesize
304KB
-
memory/2920-151-0x0000000007B00000-0x0000000007B32000-memory.dmpFilesize
200KB
-
memory/2920-150-0x0000000006940000-0x000000000695E000-memory.dmpFilesize
120KB
-
memory/3608-134-0x00000000055D0000-0x0000000005662000-memory.dmpFilesize
584KB
-
memory/3608-133-0x0000000005B80000-0x0000000006124000-memory.dmpFilesize
5.6MB
-
memory/3608-132-0x0000000000B40000-0x0000000000BFC000-memory.dmpFilesize
752KB
-
memory/3608-136-0x000000000B4D0000-0x000000000B56C000-memory.dmpFilesize
624KB
-
memory/3608-135-0x0000000005590000-0x000000000559A000-memory.dmpFilesize
40KB
-
memory/4156-138-0x0000000000000000-mapping.dmp
-
memory/5048-147-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5048-161-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5048-145-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5048-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5048-142-0x0000000000000000-mapping.dmp