Analysis
-
max time kernel
154s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2022 08:55
Static task
static1
Behavioral task
behavioral1
Sample
aef8d5e34f59619e683cef00565d370d.exe
Resource
win7-20220812-en
General
-
Target
aef8d5e34f59619e683cef00565d370d.exe
-
Size
850KB
-
MD5
aef8d5e34f59619e683cef00565d370d
-
SHA1
575ecec60ed88bd83e53ea4f42cc0e5c301635f6
-
SHA256
a6578231df36154107b54eb95b8db6b1f3e2d6477b163eda527bf8a5c57a9bab
-
SHA512
102478813cc56d174d57c730a5c8279a1950191d21528bb21c0da914b9154daa87fb1c30003baf3f051cab1bc9e528106be19a310bb133debadc5ab70b16d76b
-
SSDEEP
12288:AIbZLA7wcpdbdbdbdbduM2M29kVnCcDS3e/jMeQ695FADfphnulDX+bZuS04TXdg:LZHKBBBBf2O0OmLxhYr8GmC
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/1852-141-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/1852-142-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/1852-143-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/1852-147-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/4832-153-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/4832-154-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/4832-155-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/4832-156-0x0000000000400000-0x000000000044F000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 3212 Host.exe 4832 Host.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
aef8d5e34f59619e683cef00565d370d.exeaef8d5e34f59619e683cef00565d370d.exeHost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation aef8d5e34f59619e683cef00565d370d.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation aef8d5e34f59619e683cef00565d370d.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
aef8d5e34f59619e683cef00565d370d.exeHost.exedescription pid process target process PID 1268 set thread context of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 3212 set thread context of 4832 3212 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3856 schtasks.exe 4284 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
aef8d5e34f59619e683cef00565d370d.exeHost.exepid process 1268 aef8d5e34f59619e683cef00565d370d.exe 1268 aef8d5e34f59619e683cef00565d370d.exe 1268 aef8d5e34f59619e683cef00565d370d.exe 3212 Host.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aef8d5e34f59619e683cef00565d370d.exeHost.exedescription pid process Token: SeDebugPrivilege 1268 aef8d5e34f59619e683cef00565d370d.exe Token: SeDebugPrivilege 3212 Host.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
aef8d5e34f59619e683cef00565d370d.exeaef8d5e34f59619e683cef00565d370d.exeHost.exedescription pid process target process PID 1268 wrote to memory of 3856 1268 aef8d5e34f59619e683cef00565d370d.exe schtasks.exe PID 1268 wrote to memory of 3856 1268 aef8d5e34f59619e683cef00565d370d.exe schtasks.exe PID 1268 wrote to memory of 3856 1268 aef8d5e34f59619e683cef00565d370d.exe schtasks.exe PID 1268 wrote to memory of 4548 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 4548 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 4548 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1268 wrote to memory of 1852 1268 aef8d5e34f59619e683cef00565d370d.exe aef8d5e34f59619e683cef00565d370d.exe PID 1852 wrote to memory of 3212 1852 aef8d5e34f59619e683cef00565d370d.exe Host.exe PID 1852 wrote to memory of 3212 1852 aef8d5e34f59619e683cef00565d370d.exe Host.exe PID 1852 wrote to memory of 3212 1852 aef8d5e34f59619e683cef00565d370d.exe Host.exe PID 3212 wrote to memory of 4284 3212 Host.exe schtasks.exe PID 3212 wrote to memory of 4284 3212 Host.exe schtasks.exe PID 3212 wrote to memory of 4284 3212 Host.exe schtasks.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe PID 3212 wrote to memory of 4832 3212 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aef8d5e34f59619e683cef00565d370d.exe"C:\Users\Admin\AppData\Local\Temp\aef8d5e34f59619e683cef00565d370d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ragCcuTTl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp599.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\aef8d5e34f59619e683cef00565d370d.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\aef8d5e34f59619e683cef00565d370d.exe"{path}"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ragCcuTTl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F68.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp599.tmpFilesize
1KB
MD53cad5aee22faf58544b1d4b7285304dd
SHA1a85a6913796f129f4aea1ecc696127bf8aed6b20
SHA256aa2a75dee9bea8ff35a01f3287f0f461a39ba8912cdf367849ce51c9ce5aa428
SHA5121ea5ee1d79d874399183cfd29e36ced57eced911c879c4fd75ffdb40ce6fe6ea2f4ed60e2546444e654f93bb50872e44bff6b32787d8c9a86dc268397b14ba67
-
C:\Users\Admin\AppData\Local\Temp\tmp9F68.tmpFilesize
1KB
MD53cad5aee22faf58544b1d4b7285304dd
SHA1a85a6913796f129f4aea1ecc696127bf8aed6b20
SHA256aa2a75dee9bea8ff35a01f3287f0f461a39ba8912cdf367849ce51c9ce5aa428
SHA5121ea5ee1d79d874399183cfd29e36ced57eced911c879c4fd75ffdb40ce6fe6ea2f4ed60e2546444e654f93bb50872e44bff6b32787d8c9a86dc268397b14ba67
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
850KB
MD5aef8d5e34f59619e683cef00565d370d
SHA1575ecec60ed88bd83e53ea4f42cc0e5c301635f6
SHA256a6578231df36154107b54eb95b8db6b1f3e2d6477b163eda527bf8a5c57a9bab
SHA512102478813cc56d174d57c730a5c8279a1950191d21528bb21c0da914b9154daa87fb1c30003baf3f051cab1bc9e528106be19a310bb133debadc5ab70b16d76b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
850KB
MD5aef8d5e34f59619e683cef00565d370d
SHA1575ecec60ed88bd83e53ea4f42cc0e5c301635f6
SHA256a6578231df36154107b54eb95b8db6b1f3e2d6477b163eda527bf8a5c57a9bab
SHA512102478813cc56d174d57c730a5c8279a1950191d21528bb21c0da914b9154daa87fb1c30003baf3f051cab1bc9e528106be19a310bb133debadc5ab70b16d76b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
850KB
MD5aef8d5e34f59619e683cef00565d370d
SHA1575ecec60ed88bd83e53ea4f42cc0e5c301635f6
SHA256a6578231df36154107b54eb95b8db6b1f3e2d6477b163eda527bf8a5c57a9bab
SHA512102478813cc56d174d57c730a5c8279a1950191d21528bb21c0da914b9154daa87fb1c30003baf3f051cab1bc9e528106be19a310bb133debadc5ab70b16d76b
-
memory/1268-135-0x0000000005170000-0x000000000520C000-memory.dmpFilesize
624KB
-
memory/1268-136-0x0000000005230000-0x000000000523A000-memory.dmpFilesize
40KB
-
memory/1268-134-0x00000000050D0000-0x0000000005162000-memory.dmpFilesize
584KB
-
memory/1268-132-0x00000000005F0000-0x00000000006CA000-memory.dmpFilesize
872KB
-
memory/1268-133-0x00000000057E0000-0x0000000005D84000-memory.dmpFilesize
5.6MB
-
memory/1852-140-0x0000000000000000-mapping.dmp
-
memory/1852-141-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1852-142-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1852-143-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1852-147-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/3212-144-0x0000000000000000-mapping.dmp
-
memory/3856-137-0x0000000000000000-mapping.dmp
-
memory/4284-148-0x0000000000000000-mapping.dmp
-
memory/4548-139-0x0000000000000000-mapping.dmp
-
memory/4832-150-0x0000000000000000-mapping.dmp
-
memory/4832-153-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4832-154-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4832-155-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4832-156-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB