Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
03-10-2022 03:29
General
-
Target
3f153b9bfc044bb0c370cabd0496c8a6.exe
-
Size
1.1MB
-
MD5
3f153b9bfc044bb0c370cabd0496c8a6
-
SHA1
f98e3e3a0f5fc735f7167367fa272b5365595548
-
SHA256
67b10001ec5c141e48e61d73c2c4d8c2c1170eecfbe8732ea5b3069d6cd333b0
-
SHA512
a53caea88f5719ec51abbfa119aa4cfd0df9a4d90acd33356008bcfba2c45bdf60a6bacc69512969367dcc86c388da2d017bc1a7bfaed6c7cb1dc18fcf483982
-
SSDEEP
24576:MAOcZXgZd9/37Y0W8AHei8Jluw0ixrZYZj7w84cKSVlioyvt1qztey4ZodO:a3X7DLJYLilZYZjUcKsscey4Z7
Malware Config
Signatures
-
NetWire RAT payload 4 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f153b9bfc044bb0c370cabd0496c8a6.exe"C:\Users\Admin\AppData\Local\Temp\3f153b9bfc044bb0c370cabd0496c8a6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1_63\iblekdu.pif"C:\Users\Admin\AppData\Roaming\1_63\iblekdu.pif" oktfka.tel2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\1_63\gbtbesnvka.soxFilesize
255KB
MD5994e61c5fbfab669f92fe05ad6c41261
SHA1baf03170eb86687bc99538a4e20da67bc865a30a
SHA256751d70e4c128e63edf3cb9a1318a93c26e015afffa49c068ef9a2299aa1c3419
SHA512aac40c80127e4b5d31a452918cad4f05a3c727e262f2f304e0a2c4d755c6840bd7005ce67f400c422b58c459624cd7d2c6cef251822a62aa704db77049eba144
-
C:\Users\Admin\AppData\Roaming\1_63\iblekdu.pifFilesize
1.3MB
MD592b9ea22338dcd34bc1d8bef60a635a4
SHA1b7da7f7f1533e073463ba02f986e5c17e15d39c3
SHA25621dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0
SHA512ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5
-
C:\Users\Admin\AppData\Roaming\1_63\iblekdu.pifFilesize
1.3MB
MD592b9ea22338dcd34bc1d8bef60a635a4
SHA1b7da7f7f1533e073463ba02f986e5c17e15d39c3
SHA25621dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0
SHA512ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5
-
C:\Users\Admin\AppData\Roaming\1_63\oktfka.telFilesize
108.1MB
MD52614f99057f77ea896bf754df72c1a5b
SHA1b39d3f49f7df041f133058a6049ac0e003990067
SHA25684533a67653704948d5a13b26a07414409e9d90dbadde2832ad8dd77c635a1e1
SHA51238ac71fb7b5cd3b583aff749e67fbfd11e9ea3cc765ef4c5da63af41274e09b94ff6720ffc0c6b373d158000a47bee232ec2209ad3f7284f505bb9607d3ddc9c
-
C:\Users\Admin\AppData\Roaming\1_63\xrldqwbq.exeFilesize
60KB
MD58832c45bc05321379de0200c7819b9b3
SHA1bf5d00fcc81dd64ca3bdaec714efae9b0e7b961d
SHA256ae785b502e2d1136430d3c8b0a080534170d1d5e0466091113ff1fb967a77f25
SHA5125b3cdb80bf3f576cbedb55259038dc534f394ef48408dc7cecb74ab8c664b70b3c2fc79b9e9ac84f1819714345508470da2b67e56f9d818daafba4e34d597fbf
-
memory/212-132-0x0000000000000000-mapping.dmp
-
memory/1872-138-0x0000000000F00000-0x00000000015F5000-memory.dmpFilesize
7.0MB
-
memory/1872-139-0x0000000000F026D0-mapping.dmp
-
memory/1872-141-0x0000000000F00000-0x00000000015F5000-memory.dmpFilesize
7.0MB
-
memory/1872-142-0x0000000000F00000-0x00000000015F5000-memory.dmpFilesize
7.0MB