Analysis
-
max time kernel
54s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-09-2022 09:54
Static task
static1
Behavioral task
behavioral1
Sample
F02EVEOU.exe
Resource
win7-20220812-en
General
-
Target
F02EVEOU.exe
-
Size
941KB
-
MD5
bdac02fde5e13cb5c08b10df39cfe445
-
SHA1
85f0703fd663c0fb491cfb71ebe5609f78312a73
-
SHA256
9e90590b4333c2a963369cabf3c7671037039829c6d42a51f824356e621dff86
-
SHA512
2df6aa5c62078bd3b66300b380ee639c1736eabba9a7c4386ac0db5494e771fccd607d8dc899a2a0737ad09eeb94350a8b37f6836e8cc803218679888f80a804
-
SSDEEP
24576:ZZ5+XY+mzo3bvrn23nt+uK6ogSOY2OKP1:D5YlmzMjcocoOYR
Malware Config
Extracted
netwire
212.193.30.230:3345
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@9
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1696-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1696-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1696-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1696-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1696-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1696-75-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1696-78-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1696-80-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
F02EVEOU.exedescription pid process target process PID 1772 set thread context of 1696 1772 F02EVEOU.exe F02EVEOU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 624 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
F02EVEOU.exedescription pid process target process PID 1772 wrote to memory of 624 1772 F02EVEOU.exe powershell.exe PID 1772 wrote to memory of 624 1772 F02EVEOU.exe powershell.exe PID 1772 wrote to memory of 624 1772 F02EVEOU.exe powershell.exe PID 1772 wrote to memory of 624 1772 F02EVEOU.exe powershell.exe PID 1772 wrote to memory of 1316 1772 F02EVEOU.exe schtasks.exe PID 1772 wrote to memory of 1316 1772 F02EVEOU.exe schtasks.exe PID 1772 wrote to memory of 1316 1772 F02EVEOU.exe schtasks.exe PID 1772 wrote to memory of 1316 1772 F02EVEOU.exe schtasks.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe PID 1772 wrote to memory of 1696 1772 F02EVEOU.exe F02EVEOU.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\F02EVEOU.exe"C:\Users\Admin\AppData\Local\Temp\F02EVEOU.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FZCOqq.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZCOqq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE5DD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\F02EVEOU.exe"C:\Users\Admin\AppData\Local\Temp\F02EVEOU.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE5DD.tmpFilesize
1KB
MD55cf29fb412eb5396f3e53bc7b895ce8f
SHA124e94861ffe58d07826b5b57fc6d9ce1384aa79d
SHA25697e78655b25c4ae1a39478ba094e1bb62dac46fe630cbf6990c8cbd37783c46b
SHA512c8e395f84472f383aec733e480326ea0115873309e3c4a3031165fc388a08b78728c59ae02a139b38880ea9616e92b510bff9165b6554f2ab7fcb6090497fc07
-
memory/624-59-0x0000000000000000-mapping.dmp
-
memory/624-81-0x000000006EB40000-0x000000006F0EB000-memory.dmpFilesize
5.7MB
-
memory/624-79-0x000000006EB40000-0x000000006F0EB000-memory.dmpFilesize
5.7MB
-
memory/1316-60-0x0000000000000000-mapping.dmp
-
memory/1696-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1696-78-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1696-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1696-75-0x000000000040242D-mapping.dmp
-
memory/1696-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1696-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1696-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1696-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1696-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1696-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1696-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1772-54-0x0000000000980000-0x0000000000A72000-memory.dmpFilesize
968KB
-
memory/1772-63-0x0000000004EE0000-0x0000000004F0E000-memory.dmpFilesize
184KB
-
memory/1772-58-0x0000000005F30000-0x0000000005FB8000-memory.dmpFilesize
544KB
-
memory/1772-56-0x0000000000740000-0x0000000000758000-memory.dmpFilesize
96KB
-
memory/1772-57-0x0000000000760000-0x000000000076C000-memory.dmpFilesize
48KB
-
memory/1772-55-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB