Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 07:38
Static task
static1
Behavioral task
behavioral1
Sample
95b5d76bfb2204011333248cc121b5a4.exe
Resource
win7-20220812-en
General
-
Target
95b5d76bfb2204011333248cc121b5a4.exe
-
Size
882KB
-
MD5
95b5d76bfb2204011333248cc121b5a4
-
SHA1
6faea7983c34f12cec7d22184be0eb1693e0abaf
-
SHA256
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e
-
SHA512
966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152
-
SSDEEP
12288:eP9sJ2iNZrmsAJVSsuTEa0nKYVNp1X8bX+r9k3RADqjJ5n5OiU0rZIG41r5XiXoT:ePiJ1rasmLNaGKgNb8+rEjr5G
Malware Config
Extracted
Family |
netwire |
C2 |
37.0.14.206:3384 |
Attributes |
activex_autorun false
copy_executable true
delete_original false
host_id HostId-%Rand%
install_path %AppData%\Install\Host.exe
keylogger_dir %AppData%\Logs\
lock_executable true
offline_keylogger true
password Password234
registry_autorun false
use_mutex false |
Signatures
-
NetWire RAT payload ⋅ 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4224-143-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4224-145-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4224-149-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3108-156-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3108-157-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE ⋅ 2 IoCs
Processes:
Host.exeHost.exepid process 4496 Host.exe 3108 Host.exe -
Checks computer location settings ⋅ 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
95b5d76bfb2204011333248cc121b5a4.exe95b5d76bfb2204011333248cc121b5a4.exeHost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 95b5d76bfb2204011333248cc121b5a4.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 95b5d76bfb2204011333248cc121b5a4.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Host.exe -
Suspicious use of SetThreadContext ⋅ 2 IoCs
Processes:
95b5d76bfb2204011333248cc121b5a4.exeHost.exedescription pid process target process PID 3356 set thread context of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 4496 set thread context of 3108 4496 Host.exe Host.exe -
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) ⋅ 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
TTPs:
Processes:
schtasks.exeschtasks.exepid process 5080 schtasks.exe 3396 schtasks.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 8 IoCs
Processes:
95b5d76bfb2204011333248cc121b5a4.exeHost.exepid process 3356 95b5d76bfb2204011333248cc121b5a4.exe 3356 95b5d76bfb2204011333248cc121b5a4.exe 3356 95b5d76bfb2204011333248cc121b5a4.exe 3356 95b5d76bfb2204011333248cc121b5a4.exe 3356 95b5d76bfb2204011333248cc121b5a4.exe 3356 95b5d76bfb2204011333248cc121b5a4.exe 3356 95b5d76bfb2204011333248cc121b5a4.exe 4496 Host.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
Processes:
95b5d76bfb2204011333248cc121b5a4.exeHost.exedescription pid process Token: SeDebugPrivilege 3356 95b5d76bfb2204011333248cc121b5a4.exe Token: SeDebugPrivilege 4496 Host.exe -
Suspicious use of WriteProcessMemory ⋅ 40 IoCs
Processes:
95b5d76bfb2204011333248cc121b5a4.exe95b5d76bfb2204011333248cc121b5a4.exeHost.exedescription pid process target process PID 3356 wrote to memory of 5080 3356 95b5d76bfb2204011333248cc121b5a4.exe schtasks.exe PID 3356 wrote to memory of 5080 3356 95b5d76bfb2204011333248cc121b5a4.exe schtasks.exe PID 3356 wrote to memory of 5080 3356 95b5d76bfb2204011333248cc121b5a4.exe schtasks.exe PID 3356 wrote to memory of 3932 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 3932 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 3932 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4652 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4652 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4652 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4124 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4124 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4124 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 3356 wrote to memory of 4224 3356 95b5d76bfb2204011333248cc121b5a4.exe 95b5d76bfb2204011333248cc121b5a4.exe PID 4224 wrote to memory of 4496 4224 95b5d76bfb2204011333248cc121b5a4.exe Host.exe PID 4224 wrote to memory of 4496 4224 95b5d76bfb2204011333248cc121b5a4.exe Host.exe PID 4224 wrote to memory of 4496 4224 95b5d76bfb2204011333248cc121b5a4.exe Host.exe PID 4496 wrote to memory of 3396 4496 Host.exe schtasks.exe PID 4496 wrote to memory of 3396 4496 Host.exe schtasks.exe PID 4496 wrote to memory of 3396 4496 Host.exe schtasks.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe PID 4496 wrote to memory of 3108 4496 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe"C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe"Checks computer location settingsSuspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE94B.tmp"Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe"{path}"
-
C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe"{path}"
-
C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe"{path}"
-
C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe"{path}"Checks computer location settingsSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"Executes dropped EXEChecks computer location settingsSuspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5360.tmp"Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"Executes dropped EXE
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5360.tmpMD5
65f892aa7144c7be9e9f0a64060f5f79
SHA133d937d86129a4c23affae32947812eb136fdacb
SHA256fae46df3949c6dc59024f3dfbb59c659f1ea3f1ee8f6577a86da8f61af455d3c
SHA51256585dce966d86b92a31e3384fe406b29a267da169efd8687552d3b927ddadb92579f83297866aeea394ac6c46abb3bd6cce605e9bd66c50091ff066024aca0f
-
C:\Users\Admin\AppData\Local\Temp\tmpE94B.tmpMD5
65f892aa7144c7be9e9f0a64060f5f79
SHA133d937d86129a4c23affae32947812eb136fdacb
SHA256fae46df3949c6dc59024f3dfbb59c659f1ea3f1ee8f6577a86da8f61af455d3c
SHA51256585dce966d86b92a31e3384fe406b29a267da169efd8687552d3b927ddadb92579f83297866aeea394ac6c46abb3bd6cce605e9bd66c50091ff066024aca0f
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b5d76bfb2204011333248cc121b5a4
SHA16faea7983c34f12cec7d22184be0eb1693e0abaf
SHA256849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e
SHA512966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b5d76bfb2204011333248cc121b5a4
SHA16faea7983c34f12cec7d22184be0eb1693e0abaf
SHA256849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e
SHA512966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b5d76bfb2204011333248cc121b5a4
SHA16faea7983c34f12cec7d22184be0eb1693e0abaf
SHA256849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e
SHA512966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152
-
memory/3108-156-0x0000000000400000-0x0000000000433000-memory.dmp
-
memory/3108-157-0x0000000000400000-0x0000000000433000-memory.dmp
-
memory/3108-152-0x0000000000000000-mapping.dmp
-
memory/3356-136-0x0000000005960000-0x000000000596A000-memory.dmp
-
memory/3356-135-0x0000000005A10000-0x0000000005AAC000-memory.dmp
-
memory/3356-134-0x0000000005970000-0x0000000005A02000-memory.dmp
-
memory/3356-133-0x0000000005E80000-0x0000000006424000-memory.dmp
-
memory/3356-132-0x0000000000E80000-0x0000000000F62000-memory.dmp
-
memory/3396-150-0x0000000000000000-mapping.dmp
-
memory/3932-139-0x0000000000000000-mapping.dmp
-
memory/4124-141-0x0000000000000000-mapping.dmp
-
memory/4224-149-0x0000000000400000-0x0000000000433000-memory.dmp
-
memory/4224-145-0x0000000000400000-0x0000000000433000-memory.dmp
-
memory/4224-143-0x0000000000400000-0x0000000000433000-memory.dmp
-
memory/4224-142-0x0000000000000000-mapping.dmp
-
memory/4496-146-0x0000000000000000-mapping.dmp
-
memory/4652-140-0x0000000000000000-mapping.dmp
-
memory/5080-137-0x0000000000000000-mapping.dmp