Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2022 23:26
Static task
static1
Behavioral task
behavioral1
Sample
16f098e9ce7d2c6c0575af51f9dc139d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
16f098e9ce7d2c6c0575af51f9dc139d.exe
Resource
win10v2004-20220812-en
General
-
Target
16f098e9ce7d2c6c0575af51f9dc139d.exe
-
Size
904KB
-
MD5
16f098e9ce7d2c6c0575af51f9dc139d
-
SHA1
19982bb99284f8ba1d0dfb70356a36b798cf7210
-
SHA256
288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
-
SHA512
44535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
SSDEEP
12288:7aWzgMg7v3qnCiuErQohh0F4JCJ8lnyOcSyck41PNvDWpWTis+0Vz7w:OaHMv6CyrjtnyOcS5k8DWpSnw
Malware Config
Extracted
netwire
musaad1995-60255.portmap.host:60255
-
activex_autorun
false
-
activex_key
{0Q55O7T5-7PG8-1407-8Y6O-8DDRN68HAD86}
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Local\Microsoft\OneDrive\OneDrive.exe
-
keylogger_dir
OneDrive.lnk
-
lock_executable
false
-
mutex
vMnKWPIY
-
offline_keylogger
false
-
password
999000
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/3540-134-0x00000000000C0000-0x0000000000110000-memory.dmp netwire behavioral2/memory/3540-135-0x00000000000C0000-0x0000000000110000-memory.dmp netwire behavioral2/memory/3540-136-0x00000000000C0000-0x0000000000110000-memory.dmp netwire behavioral2/memory/3540-142-0x00000000000C0000-0x0000000000110000-memory.dmp netwire behavioral2/memory/4028-147-0x00000000000C0000-0x0000000000110000-memory.dmp netwire behavioral2/memory/4028-148-0x00000000000C0000-0x0000000000110000-memory.dmp netwire behavioral2/memory/4028-150-0x00000000000C0000-0x0000000000110000-memory.dmp netwire behavioral2/memory/4028-151-0x00000000000C0000-0x0000000000110000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
OneDrive.exeOneDrive.exepid process 4368 OneDrive.exe 4028 OneDrive.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
OneDrive.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0Q55O7T5-7PG8-1407-8Y6O-8DDRN68HAD86} OneDrive.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0Q55O7T5-7PG8-1407-8Y6O-8DDRN68HAD86}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Local\\Microsoft\\OneDrive\\OneDrive.exe\"" OneDrive.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
16f098e9ce7d2c6c0575af51f9dc139d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 16f098e9ce7d2c6c0575af51f9dc139d.exe -
Drops startup file 1 IoCs
Processes:
OneDrive.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk OneDrive.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
OneDrive.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]2ý0‰TXöX𠺪« = "C:\\Users\\Admin\\AppData\\Roaming\\Local\\Microsoft\\OneDrive\\OneDrive.exe" OneDrive.exe -
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1248-132-0x0000000000400000-0x00000000004B2000-memory.dmp autoit_exe behavioral2/memory/3540-138-0x0000000000400000-0x00000000004B2000-memory.dmp autoit_exe behavioral2/memory/1248-137-0x0000000000400000-0x00000000004B2000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe autoit_exe C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe autoit_exe behavioral2/memory/4368-144-0x0000000000400000-0x00000000004B2000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe autoit_exe behavioral2/memory/4368-149-0x0000000000400000-0x00000000004B2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
16f098e9ce7d2c6c0575af51f9dc139d.exeOneDrive.exedescription pid process target process PID 1248 set thread context of 3540 1248 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 4368 set thread context of 4028 4368 OneDrive.exe OneDrive.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
16f098e9ce7d2c6c0575af51f9dc139d.exe16f098e9ce7d2c6c0575af51f9dc139d.exeOneDrive.exedescription pid process target process PID 1248 wrote to memory of 3540 1248 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1248 wrote to memory of 3540 1248 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1248 wrote to memory of 3540 1248 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1248 wrote to memory of 3540 1248 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 1248 wrote to memory of 3540 1248 16f098e9ce7d2c6c0575af51f9dc139d.exe 16f098e9ce7d2c6c0575af51f9dc139d.exe PID 3540 wrote to memory of 4368 3540 16f098e9ce7d2c6c0575af51f9dc139d.exe OneDrive.exe PID 3540 wrote to memory of 4368 3540 16f098e9ce7d2c6c0575af51f9dc139d.exe OneDrive.exe PID 3540 wrote to memory of 4368 3540 16f098e9ce7d2c6c0575af51f9dc139d.exe OneDrive.exe PID 4368 wrote to memory of 4028 4368 OneDrive.exe OneDrive.exe PID 4368 wrote to memory of 4028 4368 OneDrive.exe OneDrive.exe PID 4368 wrote to memory of 4028 4368 OneDrive.exe OneDrive.exe PID 4368 wrote to memory of 4028 4368 OneDrive.exe OneDrive.exe PID 4368 wrote to memory of 4028 4368 OneDrive.exe OneDrive.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16f098e9ce7d2c6c0575af51f9dc139d.exe"C:\Users\Admin\AppData\Local\Temp\16f098e9ce7d2c6c0575af51f9dc139d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\16f098e9ce7d2c6c0575af51f9dc139d.exe"C:\Users\Admin\AppData\Local\Temp\16f098e9ce7d2c6c0575af51f9dc139d.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exeFilesize
904KB
MD516f098e9ce7d2c6c0575af51f9dc139d
SHA119982bb99284f8ba1d0dfb70356a36b798cf7210
SHA256288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
SHA51244535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exeFilesize
904KB
MD516f098e9ce7d2c6c0575af51f9dc139d
SHA119982bb99284f8ba1d0dfb70356a36b798cf7210
SHA256288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
SHA51244535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
C:\Users\Admin\AppData\Roaming\Local\Microsoft\OneDrive\OneDrive.exeFilesize
904KB
MD516f098e9ce7d2c6c0575af51f9dc139d
SHA119982bb99284f8ba1d0dfb70356a36b798cf7210
SHA256288719cc7ce53a7dc829be4a5d261e0c9229aca9097b72bea018fa7c9aa84000
SHA51244535ec96b64d047055018661679e12632113fd3238b3492b6dcc730e1a78b4028deca62d529370e0e3b089984080d4477047bda4ac6a762da14573dcdf8125f
-
memory/1248-137-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1248-132-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3540-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3540-133-0x0000000000000000-mapping.dmp
-
memory/3540-136-0x00000000000C0000-0x0000000000110000-memory.dmpFilesize
320KB
-
memory/3540-135-0x00000000000C0000-0x0000000000110000-memory.dmpFilesize
320KB
-
memory/3540-134-0x00000000000C0000-0x0000000000110000-memory.dmpFilesize
320KB
-
memory/3540-142-0x00000000000C0000-0x0000000000110000-memory.dmpFilesize
320KB
-
memory/4028-148-0x00000000000C0000-0x0000000000110000-memory.dmpFilesize
320KB
-
memory/4028-143-0x0000000000000000-mapping.dmp
-
memory/4028-147-0x00000000000C0000-0x0000000000110000-memory.dmpFilesize
320KB
-
memory/4028-150-0x00000000000C0000-0x0000000000110000-memory.dmpFilesize
320KB
-
memory/4028-151-0x00000000000C0000-0x0000000000110000-memory.dmpFilesize
320KB
-
memory/4368-144-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4368-139-0x0000000000000000-mapping.dmp
-
memory/4368-149-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB