Analysis

  • max time kernel
    66s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-09-2022 15:11

General

  • Target

    Quote_PDF.js

  • Size

    416KB

  • MD5

    00d505983f81b198c0e96550cdfc665e

  • SHA1

    c8e5ab47efb9cda85683fcc808ea02677ea27441

  • SHA256

    888e73dd8c2651b8da9e04a8521d1d82c312c3d59860df4dc18cbacbbc3f31af

  • SHA512

    7b15a4da4d0571979d0c9f25308dd48f2cc15637de7cbc52a481fb3baf25a4d96c1cd3bbcc9928166ea41419cc72166ee053ddae85618ff8412c0ce9c79ce504

  • SSDEEP

    6144:XWfS/GKH18Vhwsm8JWhz660+O3qamLA6cuZPrX5Enr24XenZ7TAJo3uO:XWfiNcJWhz65z3q+6c+PTG67d

Malware Config

Signatures

  • NetWire RAT payload ⋅ 4 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE ⋅ 2 IoCs
  • Checks computer location settings ⋅ 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file ⋅ 1 IoCs
  • Adds Run key to start application ⋅ 2 TTPs 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory ⋅ 8 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Quote_PDF.js
    Checks computer location settings
    Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\kJcrNvTGLP.js"
      PID:3032
    • C:\Users\Admin\AppData\Roaming\Host Ip 185.216.71.251.exe
      "C:\Users\Admin\AppData\Roaming\Host Ip 185.216.71.251.exe"
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3252
      • C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe
        "C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe"
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        PID:5080

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe
                      MD5

                      a8edd52c5edfe91da90ebee24b51d3c6

                      SHA1

                      fc36350b93c6974865eaa7f00a98fa281d1ff7fd

                      SHA256

                      35d0bbb6787ae3fb3e155f2eaad36e5f4bb5255e7bb95b759790cc3cc048839d

                      SHA512

                      97278bb3967c6ec10d221820d0d50d3582e6fd3975318c882efbecc6b87bfc83f9f58d927e81ecb95ea8a510929591834a27a23e56dc38e8d091f95f9a31ca14

                    • C:\Users\Admin\AppData\Roaming\Gooogle\Note.exe
                      MD5

                      a8edd52c5edfe91da90ebee24b51d3c6

                      SHA1

                      fc36350b93c6974865eaa7f00a98fa281d1ff7fd

                      SHA256

                      35d0bbb6787ae3fb3e155f2eaad36e5f4bb5255e7bb95b759790cc3cc048839d

                      SHA512

                      97278bb3967c6ec10d221820d0d50d3582e6fd3975318c882efbecc6b87bfc83f9f58d927e81ecb95ea8a510929591834a27a23e56dc38e8d091f95f9a31ca14

                    • C:\Users\Admin\AppData\Roaming\Host Ip 185.216.71.251.exe
                      MD5

                      a8edd52c5edfe91da90ebee24b51d3c6

                      SHA1

                      fc36350b93c6974865eaa7f00a98fa281d1ff7fd

                      SHA256

                      35d0bbb6787ae3fb3e155f2eaad36e5f4bb5255e7bb95b759790cc3cc048839d

                      SHA512

                      97278bb3967c6ec10d221820d0d50d3582e6fd3975318c882efbecc6b87bfc83f9f58d927e81ecb95ea8a510929591834a27a23e56dc38e8d091f95f9a31ca14

                    • C:\Users\Admin\AppData\Roaming\Host Ip 185.216.71.251.exe
                      MD5

                      a8edd52c5edfe91da90ebee24b51d3c6

                      SHA1

                      fc36350b93c6974865eaa7f00a98fa281d1ff7fd

                      SHA256

                      35d0bbb6787ae3fb3e155f2eaad36e5f4bb5255e7bb95b759790cc3cc048839d

                      SHA512

                      97278bb3967c6ec10d221820d0d50d3582e6fd3975318c882efbecc6b87bfc83f9f58d927e81ecb95ea8a510929591834a27a23e56dc38e8d091f95f9a31ca14

                    • C:\Users\Admin\AppData\Roaming\kJcrNvTGLP.js
                      MD5

                      d29a81dca145e2c8e4fe0cd841c7f0b1

                      SHA1

                      40ddc0481967acd0a6ef243588b4040aa2628c0c

                      SHA256

                      9617cedbeac15fa6287ee42ff30557d2edbae5b85267be757c368dcce56a9cf8

                      SHA512

                      8e7a7b676abcd163b7cead6440c614098977460abc61f257cf410f70e0b6ae87bfd8ee64bba29df78e11bcfbb39b0c639c61f2b676b07d817d02f181cf51e7e7

                    • memory/3032-132-0x0000000000000000-mapping.dmp
                    • memory/3252-134-0x0000000000000000-mapping.dmp
                    • memory/5080-137-0x0000000000000000-mapping.dmp