Analysis
-
max time kernel
141s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-10-2022 08:55
Static task
static1
Behavioral task
behavioral1
Sample
aef8d5e34f59619e683cef00565d370d.exe
Resource
win7-20220812-en
General
-
Target
aef8d5e34f59619e683cef00565d370d.exe
-
Size
850KB
-
MD5
aef8d5e34f59619e683cef00565d370d
-
SHA1
575ecec60ed88bd83e53ea4f42cc0e5c301635f6
-
SHA256
a6578231df36154107b54eb95b8db6b1f3e2d6477b163eda527bf8a5c57a9bab
-
SHA512
102478813cc56d174d57c730a5c8279a1950191d21528bb21c0da914b9154daa87fb1c30003baf3f051cab1bc9e528106be19a310bb133debadc5ab70b16d76b
-
SSDEEP
12288:AIbZLA7wcpdbdbdbdbduM2M29kVnCcDS3e/jMeQ695FADfphnulDX+bZuS04TXdg:LZHKBBBBf2O0OmLxhYr8GmC
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1980-66-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1980-68-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1980-69-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1980-71-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1980-72-0x000000000041AD7B-mapping.dmp netwire behavioral1/memory/1980-75-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1980-79-0x0000000000400000-0x000000000044F000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
Host.exepid process 1492 Host.exe -
Loads dropped DLL 1 IoCs
Processes:
aef8d5e34f59619e683cef00565d370d.exepid process 1980 aef8d5e34f59619e683cef00565d370d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aef8d5e34f59619e683cef00565d370d.exedescription pid process target process PID 1908 set thread context of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
aef8d5e34f59619e683cef00565d370d.exepid process 1908 aef8d5e34f59619e683cef00565d370d.exe 1908 aef8d5e34f59619e683cef00565d370d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
aef8d5e34f59619e683cef00565d370d.exedescription pid process Token: SeDebugPrivilege 1908 aef8d5e34f59619e683cef00565d370d.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
aef8d5e34f59619e683cef00565d370d.exeaef8d5e34f59619e683cef00565d370d.exedescription pid process target process PID 1908 wrote to memory of 852 1908 aef8d5e34f59619e683cef00565d370d.exe schtasks.exe PID 1908 wrote to memory of 852 1908 aef8d5e34f59619e683cef00565d370d.exe schtasks.exe PID 1908 wrote to memory of 852 1908 aef8d5e34f59619e683cef00565d370d.exe schtasks.exe PID 1908 wrote to memory of 852 1908 aef8d5e34f59619e683cef00565d370d.exe schtasks.exe PID 1908 wrote to memory of 1740 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1740 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1740 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1740 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1908 wrote to memory of 1980 1908 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1980 wrote to memory of 1492 1980 aef8d5e34f59619e683cef00565d370d.exe Host.exe PID 1980 wrote to memory of 1492 1980 aef8d5e34f59619e683cef00565d370d.exe Host.exe PID 1980 wrote to memory of 1492 1980 aef8d5e34f59619e683cef00565d370d.exe Host.exe PID 1980 wrote to memory of 1492 1980 aef8d5e34f59619e683cef00565d370d.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aef8d5e34f59619e683cef00565d370d.exe"C:\Users\Admin\AppData\Local\Temp\aef8d5e34f59619e683cef00565d370d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ragCcuTTl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED7B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\aef8d5e34f59619e683cef00565d370d.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\aef8d5e34f59619e683cef00565d370d.exe"{path}"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpED7B.tmpFilesize
1KB
MD5923c4777360608daaf8fa5c9627824d0
SHA1a35effbeba2028f12757347c8e38f0ee2100db7e
SHA25602d717fec051a57c757a77496e4ad5d335d38241661ba06259b43d877e4d0717
SHA5123b75bd129d9ae71e7e34d28d5d4dd1f0c8ba291dfaf952fbc3d2076bf86844811464c3011227bcfafc689b51f4edad018b08d5a5a867a9b1017409431f7f3f39
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
850KB
MD5aef8d5e34f59619e683cef00565d370d
SHA1575ecec60ed88bd83e53ea4f42cc0e5c301635f6
SHA256a6578231df36154107b54eb95b8db6b1f3e2d6477b163eda527bf8a5c57a9bab
SHA512102478813cc56d174d57c730a5c8279a1950191d21528bb21c0da914b9154daa87fb1c30003baf3f051cab1bc9e528106be19a310bb133debadc5ab70b16d76b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
850KB
MD5aef8d5e34f59619e683cef00565d370d
SHA1575ecec60ed88bd83e53ea4f42cc0e5c301635f6
SHA256a6578231df36154107b54eb95b8db6b1f3e2d6477b163eda527bf8a5c57a9bab
SHA512102478813cc56d174d57c730a5c8279a1950191d21528bb21c0da914b9154daa87fb1c30003baf3f051cab1bc9e528106be19a310bb133debadc5ab70b16d76b
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
850KB
MD5aef8d5e34f59619e683cef00565d370d
SHA1575ecec60ed88bd83e53ea4f42cc0e5c301635f6
SHA256a6578231df36154107b54eb95b8db6b1f3e2d6477b163eda527bf8a5c57a9bab
SHA512102478813cc56d174d57c730a5c8279a1950191d21528bb21c0da914b9154daa87fb1c30003baf3f051cab1bc9e528106be19a310bb133debadc5ab70b16d76b
-
memory/852-59-0x0000000000000000-mapping.dmp
-
memory/1492-77-0x0000000000000000-mapping.dmp
-
memory/1492-81-0x0000000000B70000-0x0000000000C4A000-memory.dmpFilesize
872KB
-
memory/1908-55-0x00000000762F1000-0x00000000762F3000-memory.dmpFilesize
8KB
-
memory/1908-56-0x00000000003F0000-0x0000000000410000-memory.dmpFilesize
128KB
-
memory/1908-57-0x0000000005170000-0x000000000520A000-memory.dmpFilesize
616KB
-
memory/1908-58-0x0000000001FD0000-0x000000000202A000-memory.dmpFilesize
360KB
-
memory/1908-54-0x00000000000A0000-0x000000000017A000-memory.dmpFilesize
872KB
-
memory/1980-66-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1980-71-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1980-72-0x000000000041AD7B-mapping.dmp
-
memory/1980-75-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1980-69-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1980-68-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1980-64-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1980-62-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1980-61-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1980-79-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB