Analysis
-
max time kernel
134s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-08-2022 23:26
Static task
static1
Behavioral task
behavioral1
Sample
16f098e9ce7d2c6c0575af51f9dc139d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
16f098e9ce7d2c6c0575af51f9dc139d.exe
Resource
win10v2004-20220812-en
General
-
Target
16f098e9ce7d2c6c0575af51f9dc139d.exe
-
Size
904KB
-
MD5
16f098e9ce7d2c6c0575af51f9dc139d
-
SHA1
19982bb99284f8ba1d0dfb70356a36b798cf7210
-
SHA256
288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
-
SHA512
44535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
SSDEEP
12288:7aWzgMg7v3qnCiuErQohh0F4JCJ8lnyOcSyck41PNvDWpWTis+0Vz7w:OaHMv6CyrjtnyOcS5k8DWpSnw
Malware Config
Extracted
netwire
musaad1995-60255.portmap.host:60255
-
activex_autorun
false
-
activex_key
{0Q55O7T5-7PG8-1407-8Y6O-8DDRN68HAD86}
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Local\Microsoft\OneDrive\OneDrive.exe
-
keylogger_dir
OneDrive.lnk
-
lock_executable
false
-
mutex
vMnKWPIY
-
offline_keylogger
false
-
password
999000
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1484-57-0x00000000000B0000-0x0000000000100000-memory.dmp netwire behavioral1/memory/1484-58-0x00000000000CAE7B-mapping.dmp netwire behavioral1/memory/1484-62-0x00000000000B0000-0x0000000000100000-memory.dmp netwire behavioral1/memory/1484-63-0x00000000000B0000-0x0000000000100000-memory.dmp netwire behavioral1/memory/1484-69-0x00000000000B0000-0x0000000000100000-memory.dmp netwire behavioral1/memory/956-75-0x00000000000CAE7B-mapping.dmp netwire behavioral1/memory/956-80-0x00000000000B0000-0x0000000000100000-memory.dmp netwire behavioral1/memory/956-81-0x00000000000B0000-0x0000000000100000-memory.dmp netwire behavioral1/memory/956-82-0x00000000000B0000-0x0000000000100000-memory.dmp netwire behavioral1/memory/956-84-0x00000000000B0000-0x0000000000100000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
OneDrive.exeOneDrive.exepid process 2036 OneDrive.exe 956 OneDrive.exe -
Modifies Installed Components in the registry 2 TTPs 3 IoCs
Processes:
OneDrive.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0Q55O7T5-7PG8-1407-8Y6O-8DDRN68HAD86} OneDrive.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0Q55O7T5-7PG8-1407-8Y6O-8DDRN68HAD86}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Local\\Microsoft\\OneDrive\\OneDrive.exe\"" OneDrive.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0Q55O7T5-7PG8-1407-8Y6O-8DDRN68HAD86} OneDrive.exe -
Drops startup file 1 IoCs
Processes:
OneDrive.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk OneDrive.exe -
Loads dropped DLL 2 IoCs
Processes:
16f098e9ce7d2c6c0575af51f9dc139d.exepid process 1484 16f098e9ce7d2c6c0575af51f9dc139d.exe 1484 16f098e9ce7d2c6c0575af51f9dc139d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
OneDrive.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\]2ý0‰TXöX𠺪« = "C:\\Users\\Admin\\AppData\\Roaming\\Local\\Microsoft\\OneDrive\\OneDrive.exe" OneDrive.exe -
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1848-60-0x0000000000400000-0x00000000004B2000-memory.dmp autoit_exe behavioral1/memory/1484-64-0x0000000000400000-0x00000000004B2000-memory.dmp autoit_exe \Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe autoit_exe \Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe autoit_exe C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe autoit_exe C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe autoit_exe behavioral1/memory/2036-78-0x0000000000400000-0x00000000004B2000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
16f098e9ce7d2c6c0575af51f9dc139d.exeOneDrive.exedescription pid process target process PID 1848 set thread context of 1484 1848 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 2036 set thread context of 956 2036 OneDrive.exe OneDrive.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
16f098e9ce7d2c6c0575af51f9dc139d.exe16f098e9ce7d2c6c0575af51f9dc139d.exeOneDrive.exeOneDrive.execmd.exedescription pid process target process PID 1848 wrote to memory of 1484 1848 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1848 wrote to memory of 1484 1848 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1848 wrote to memory of 1484 1848 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1848 wrote to memory of 1484 1848 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1848 wrote to memory of 1484 1848 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1848 wrote to memory of 1484 1848 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1484 wrote to memory of 2036 1484 16f098e9ce7d2c6c0575af51f9dc139d.exe OneDrive.exe PID 1484 wrote to memory of 2036 1484 16f098e9ce7d2c6c0575af51f9dc139d.exe OneDrive.exe PID 1484 wrote to memory of 2036 1484 16f098e9ce7d2c6c0575af51f9dc139d.exe OneDrive.exe PID 1484 wrote to memory of 2036 1484 16f098e9ce7d2c6c0575af51f9dc139d.exe OneDrive.exe PID 2036 wrote to memory of 956 2036 OneDrive.exe OneDrive.exe PID 2036 wrote to memory of 956 2036 OneDrive.exe OneDrive.exe PID 2036 wrote to memory of 956 2036 OneDrive.exe OneDrive.exe PID 2036 wrote to memory of 956 2036 OneDrive.exe OneDrive.exe PID 2036 wrote to memory of 956 2036 OneDrive.exe OneDrive.exe PID 2036 wrote to memory of 956 2036 OneDrive.exe OneDrive.exe PID 956 wrote to memory of 1328 956 OneDrive.exe cmd.exe PID 956 wrote to memory of 1328 956 OneDrive.exe cmd.exe PID 956 wrote to memory of 1328 956 OneDrive.exe cmd.exe PID 956 wrote to memory of 1328 956 OneDrive.exe cmd.exe PID 1328 wrote to memory of 1352 1328 cmd.exe PING.EXE PID 1328 wrote to memory of 1352 1328 cmd.exe PING.EXE PID 1328 wrote to memory of 1352 1328 cmd.exe PING.EXE PID 1328 wrote to memory of 1352 1328 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\16f098e9ce7d2c6c0575af51f9dc139d.exe"C:\Users\Admin\AppData\Local\Temp\16f098e9ce7d2c6c0575af51f9dc139d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\16f098e9ce7d2c6c0575af51f9dc139d.exe"C:\Users\Admin\AppData\Local\Temp\16f098e9ce7d2c6c0575af51f9dc139d.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30006⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exeFilesize
904KB
MD516f098e9ce7d2c6c0575af51f9dc139d
SHA119982bb99284f8ba1d0dfb70356a36b798cf7210
SHA256288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
SHA51244535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exeFilesize
904KB
MD516f098e9ce7d2c6c0575af51f9dc139d
SHA119982bb99284f8ba1d0dfb70356a36b798cf7210
SHA256288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
SHA51244535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exeFilesize
904KB
MD516f098e9ce7d2c6c0575af51f9dc139d
SHA119982bb99284f8ba1d0dfb70356a36b798cf7210
SHA256288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
SHA51244535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exeFilesize
904KB
MD516f098e9ce7d2c6c0575af51f9dc139d
SHA119982bb99284f8ba1d0dfb70356a36b798cf7210
SHA256288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
SHA51244535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exeFilesize
904KB
MD516f098e9ce7d2c6c0575af51f9dc139d
SHA119982bb99284f8ba1d0dfb70356a36b798cf7210
SHA256288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
SHA51244535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
memory/956-84-0x00000000000B0000-0x0000000000100000-memory.dmpFilesize
320KB
-
memory/956-82-0x00000000000B0000-0x0000000000100000-memory.dmpFilesize
320KB
-
memory/956-81-0x00000000000B0000-0x0000000000100000-memory.dmpFilesize
320KB
-
memory/956-80-0x00000000000B0000-0x0000000000100000-memory.dmpFilesize
320KB
-
memory/956-75-0x00000000000CAE7B-mapping.dmp
-
memory/1328-83-0x0000000000000000-mapping.dmp
-
memory/1352-85-0x0000000000000000-mapping.dmp
-
memory/1484-62-0x00000000000B0000-0x0000000000100000-memory.dmpFilesize
320KB
-
memory/1484-69-0x00000000000B0000-0x0000000000100000-memory.dmpFilesize
320KB
-
memory/1484-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1484-63-0x00000000000B0000-0x0000000000100000-memory.dmpFilesize
320KB
-
memory/1484-58-0x00000000000CAE7B-mapping.dmp
-
memory/1484-57-0x00000000000B0000-0x0000000000100000-memory.dmpFilesize
320KB
-
memory/1484-55-0x00000000000B0000-0x0000000000100000-memory.dmpFilesize
320KB
-
memory/1848-54-0x0000000075241000-0x0000000075243000-memory.dmpFilesize
8KB
-
memory/1848-60-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2036-67-0x0000000000000000-mapping.dmp
-
memory/2036-78-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB