Analysis
-
max time kernel
146s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
12-10-2022 04:30
Static task
static1
Behavioral task
behavioral1
Sample
3f2a653458d88060d8e2dcfde4a2b396.exe
Resource
win7-20220901-en
General
-
Target
3f2a653458d88060d8e2dcfde4a2b396.exe
-
Size
793KB
-
MD5
3f2a653458d88060d8e2dcfde4a2b396
-
SHA1
8b514d159d3aad5ed0eb8b0b5ee7db53e183738e
-
SHA256
af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d
-
SHA512
a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1
-
SSDEEP
12288:RejUauu2iNaLrA7Ed3Oml1OktIQvRCUKPnN5CdTenWlCqjJ5nS4TU41WjZfX6SyG:Mjzuu1QSEd3OmTO8IQvRZKPNa0WrjrS
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 7 IoCs
resource yara_rule behavioral1/memory/1756-68-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1756-69-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1756-66-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1756-71-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1756-72-0x000000000041AD7B-mapping.dmp netwire behavioral1/memory/1756-75-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1756-79-0x0000000000400000-0x000000000044F000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
pid Process 452 Host.exe -
Loads dropped DLL 1 IoCs
pid Process 1756 3f2a653458d88060d8e2dcfde4a2b396.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1264 set thread context of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1264 3f2a653458d88060d8e2dcfde4a2b396.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1264 3f2a653458d88060d8e2dcfde4a2b396.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1264 wrote to memory of 1672 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 27 PID 1264 wrote to memory of 1672 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 27 PID 1264 wrote to memory of 1672 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 27 PID 1264 wrote to memory of 1672 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 27 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1264 wrote to memory of 1756 1264 3f2a653458d88060d8e2dcfde4a2b396.exe 29 PID 1756 wrote to memory of 452 1756 3f2a653458d88060d8e2dcfde4a2b396.exe 30 PID 1756 wrote to memory of 452 1756 3f2a653458d88060d8e2dcfde4a2b396.exe 30 PID 1756 wrote to memory of 452 1756 3f2a653458d88060d8e2dcfde4a2b396.exe 30 PID 1756 wrote to memory of 452 1756 3f2a653458d88060d8e2dcfde4a2b396.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f2a653458d88060d8e2dcfde4a2b396.exe"C:\Users\Admin\AppData\Local\Temp\3f2a653458d88060d8e2dcfde4a2b396.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DpaItRCg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp731E.tmp"2⤵
- Creates scheduled task(s)
PID:1672
-
-
C:\Users\Admin\AppData\Local\Temp\3f2a653458d88060d8e2dcfde4a2b396.exe"{path}"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
PID:452
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59e3e4a8c3b2e0b97e3d4fe3e309cfc81
SHA1f45d813383a9a4a65bcd416c02b5f529a7e065f2
SHA25605102414e35ab2a37a21a62113069ecf02ce577a1851c65821f2dcf8dbc1fd2b
SHA5120c8f7c05b18ccf718578b62d7234ded0b3947a71c1e15e03b26f697fba1a23c78715ea1d672f3981db514296a08af5f2a8f7232e71712558385d7acc99d5af09
-
Filesize
793KB
MD53f2a653458d88060d8e2dcfde4a2b396
SHA18b514d159d3aad5ed0eb8b0b5ee7db53e183738e
SHA256af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d
SHA512a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1
-
Filesize
793KB
MD53f2a653458d88060d8e2dcfde4a2b396
SHA18b514d159d3aad5ed0eb8b0b5ee7db53e183738e
SHA256af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d
SHA512a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1
-
Filesize
793KB
MD53f2a653458d88060d8e2dcfde4a2b396
SHA18b514d159d3aad5ed0eb8b0b5ee7db53e183738e
SHA256af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d
SHA512a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1