Analysis
-
max time kernel
188s -
max time network
80s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
04-10-2022 05:46
General
-
Target
e3d68e3484634f2133d390ec458c2f8e3763d5663a15df1103ec6555df873940.exe
-
Size
168KB
-
MD5
54ee381e756783fbe4f7d22ce9fb5409
-
SHA1
9f36b2e555408ab4d58eff5fa73fc53253c1e3d5
-
SHA256
e3d68e3484634f2133d390ec458c2f8e3763d5663a15df1103ec6555df873940
-
SHA512
fb8f82119423d89d251dbd2e2105e7e3615a45a6cfb36ac3521318141cfa96e41febb7e9a7c0b1ac3e734571efd356b91a75c0b5fa162646bcc17e2f2b0853c8
-
SSDEEP
3072:9IQUfIcSYq2wQAQCp5HOYbCyA7PrnMceCzzFStKHNg7c:dyjSYqwI5HA7PrnMcBzpStT
Malware Config
Signatures
-
NetWire RAT payload 1 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Executes dropped EXE 3 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 43 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3d68e3484634f2133d390ec458c2f8e3763d5663a15df1103ec6555df873940.exe"C:\Users\Admin\AppData\Local\Temp\e3d68e3484634f2133d390ec458c2f8e3763d5663a15df1103ec6555df873940.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e3d68e3484634f2133d390ec458c2f8e3763d5663a15df1103ec6555df873940.exe"C:\Users\Admin\AppData\Local\Temp\e3d68e3484634f2133d390ec458c2f8e3763d5663a15df1103ec6555df873940.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.com"C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.com"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.com"C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.com"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"5⤵
- Gathers network information
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\VYOIA.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AdobeUp" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.com" /f7⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.com"C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.com"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VYOIA.batFilesize
144B
MD5b636c1903e2edabb2dda1a7d1b02ed12
SHA1110b75f6ae8c5b134203397ea2c1154c632c896a
SHA25646aa7780e94cd6fbbe91244edf3216e5fbb4905cb6b071a53983593c1817459f
SHA5127e680bddc5ec495aa941729cc960778c3deab93d3a8eed35b9131e690dc2523490999b81be79c331829128e2ada6e8efbfb96e5f3e0429debbef71af4bd6482a
-
C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.comFilesize
168KB
MD5055ba88e8f7f984c96efff6a41e0ba16
SHA18a57abd80bceb91aa64a627e3841850fa7a3b3ec
SHA25636804546d0dce8faab0b148b27b028280971cad312a429d8bb7ea320347e54f9
SHA512e264fdbe06ce757681393aec8771401b017269654292a050acc7ae746ca0a34c7ca60f2caed928584f9269b56de6b9c9a6c9017ab13a760519c9ff85100af0cc
-
C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.comFilesize
168KB
MD5055ba88e8f7f984c96efff6a41e0ba16
SHA18a57abd80bceb91aa64a627e3841850fa7a3b3ec
SHA25636804546d0dce8faab0b148b27b028280971cad312a429d8bb7ea320347e54f9
SHA512e264fdbe06ce757681393aec8771401b017269654292a050acc7ae746ca0a34c7ca60f2caed928584f9269b56de6b9c9a6c9017ab13a760519c9ff85100af0cc
-
C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.comFilesize
168KB
MD5055ba88e8f7f984c96efff6a41e0ba16
SHA18a57abd80bceb91aa64a627e3841850fa7a3b3ec
SHA25636804546d0dce8faab0b148b27b028280971cad312a429d8bb7ea320347e54f9
SHA512e264fdbe06ce757681393aec8771401b017269654292a050acc7ae746ca0a34c7ca60f2caed928584f9269b56de6b9c9a6c9017ab13a760519c9ff85100af0cc
-
C:\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.comFilesize
168KB
MD5055ba88e8f7f984c96efff6a41e0ba16
SHA18a57abd80bceb91aa64a627e3841850fa7a3b3ec
SHA25636804546d0dce8faab0b148b27b028280971cad312a429d8bb7ea320347e54f9
SHA512e264fdbe06ce757681393aec8771401b017269654292a050acc7ae746ca0a34c7ca60f2caed928584f9269b56de6b9c9a6c9017ab13a760519c9ff85100af0cc
-
\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.comFilesize
168KB
MD5055ba88e8f7f984c96efff6a41e0ba16
SHA18a57abd80bceb91aa64a627e3841850fa7a3b3ec
SHA25636804546d0dce8faab0b148b27b028280971cad312a429d8bb7ea320347e54f9
SHA512e264fdbe06ce757681393aec8771401b017269654292a050acc7ae746ca0a34c7ca60f2caed928584f9269b56de6b9c9a6c9017ab13a760519c9ff85100af0cc
-
\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.comFilesize
168KB
MD5055ba88e8f7f984c96efff6a41e0ba16
SHA18a57abd80bceb91aa64a627e3841850fa7a3b3ec
SHA25636804546d0dce8faab0b148b27b028280971cad312a429d8bb7ea320347e54f9
SHA512e264fdbe06ce757681393aec8771401b017269654292a050acc7ae746ca0a34c7ca60f2caed928584f9269b56de6b9c9a6c9017ab13a760519c9ff85100af0cc
-
\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.comFilesize
168KB
MD5055ba88e8f7f984c96efff6a41e0ba16
SHA18a57abd80bceb91aa64a627e3841850fa7a3b3ec
SHA25636804546d0dce8faab0b148b27b028280971cad312a429d8bb7ea320347e54f9
SHA512e264fdbe06ce757681393aec8771401b017269654292a050acc7ae746ca0a34c7ca60f2caed928584f9269b56de6b9c9a6c9017ab13a760519c9ff85100af0cc
-
\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.comFilesize
168KB
MD5055ba88e8f7f984c96efff6a41e0ba16
SHA18a57abd80bceb91aa64a627e3841850fa7a3b3ec
SHA25636804546d0dce8faab0b148b27b028280971cad312a429d8bb7ea320347e54f9
SHA512e264fdbe06ce757681393aec8771401b017269654292a050acc7ae746ca0a34c7ca60f2caed928584f9269b56de6b9c9a6c9017ab13a760519c9ff85100af0cc
-
\Users\Admin\AppData\Roaming\AdobeUp\AdobeUp.comFilesize
168KB
MD5055ba88e8f7f984c96efff6a41e0ba16
SHA18a57abd80bceb91aa64a627e3841850fa7a3b3ec
SHA25636804546d0dce8faab0b148b27b028280971cad312a429d8bb7ea320347e54f9
SHA512e264fdbe06ce757681393aec8771401b017269654292a050acc7ae746ca0a34c7ca60f2caed928584f9269b56de6b9c9a6c9017ab13a760519c9ff85100af0cc
-
memory/636-85-0x0000000000410090-mapping.dmp
-
memory/636-104-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/636-112-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/688-111-0x0000000000000000-mapping.dmp
-
memory/968-74-0x0000000000000000-mapping.dmp
-
memory/988-107-0x0000000000000000-mapping.dmp
-
memory/1076-68-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB
-
memory/1076-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1076-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1076-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1076-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1076-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1076-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1076-61-0x0000000000410090-mapping.dmp
-
memory/1076-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1076-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1812-98-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1812-103-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1812-99-0x0000000000401E40-mapping.dmp
-
memory/1812-105-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1812-96-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1812-89-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1812-92-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1812-87-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1852-110-0x0000000000000000-mapping.dmp