Analysis
-
max time kernel
139s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-10-2022 11:53
Static task
static1
Behavioral task
behavioral1
Sample
5e065fed8f698980d2d3a7733cb5a966.exe
Resource
win7-20220812-en
General
-
Target
5e065fed8f698980d2d3a7733cb5a966.exe
-
Size
824KB
-
MD5
5e065fed8f698980d2d3a7733cb5a966
-
SHA1
5fbfecc629b5ab240aa50a78bc709625366f2a0f
-
SHA256
71e65562e00447d697f996d69ffc7798d96cf2b4799f27a298ce710730802428
-
SHA512
98280965921030d14b8c8cf421351f1f50522f092f8986d6d4717fdd588ddbf98d0230122f5d843c6a1d5322d7e82e51c9a7cb0c7e48932bcf0a9b38663ee3d4
-
SSDEEP
12288:Ip/c1dUEmaiIYQmWrT7vhS8EaRvULdPaV1SSe8FBCSU3Qj:z1GEmaiIYQn3zM7rN8OD3
Malware Config
Extracted
netwire
212.193.30.230:3363
212.193.30.230:3362
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Cantbeme@1
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1708-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1708-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1708-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1708-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1708-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1708-75-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1708-78-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1708-80-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1708-82-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5e065fed8f698980d2d3a7733cb5a966.exedescription pid process target process PID 960 set thread context of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5e065fed8f698980d2d3a7733cb5a966.exepowershell.exepid process 960 5e065fed8f698980d2d3a7733cb5a966.exe 1344 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5e065fed8f698980d2d3a7733cb5a966.exepowershell.exedescription pid process Token: SeDebugPrivilege 960 5e065fed8f698980d2d3a7733cb5a966.exe Token: SeDebugPrivilege 1344 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
5e065fed8f698980d2d3a7733cb5a966.exedescription pid process target process PID 960 wrote to memory of 1344 960 5e065fed8f698980d2d3a7733cb5a966.exe powershell.exe PID 960 wrote to memory of 1344 960 5e065fed8f698980d2d3a7733cb5a966.exe powershell.exe PID 960 wrote to memory of 1344 960 5e065fed8f698980d2d3a7733cb5a966.exe powershell.exe PID 960 wrote to memory of 1344 960 5e065fed8f698980d2d3a7733cb5a966.exe powershell.exe PID 960 wrote to memory of 648 960 5e065fed8f698980d2d3a7733cb5a966.exe schtasks.exe PID 960 wrote to memory of 648 960 5e065fed8f698980d2d3a7733cb5a966.exe schtasks.exe PID 960 wrote to memory of 648 960 5e065fed8f698980d2d3a7733cb5a966.exe schtasks.exe PID 960 wrote to memory of 648 960 5e065fed8f698980d2d3a7733cb5a966.exe schtasks.exe PID 960 wrote to memory of 600 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 600 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 600 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 600 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe PID 960 wrote to memory of 1708 960 5e065fed8f698980d2d3a7733cb5a966.exe 5e065fed8f698980d2d3a7733cb5a966.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e065fed8f698980d2d3a7733cb5a966.exe"C:\Users\Admin\AppData\Local\Temp\5e065fed8f698980d2d3a7733cb5a966.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lwhmyIrfBPFtC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lwhmyIrfBPFtC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF0E5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\5e065fed8f698980d2d3a7733cb5a966.exe"C:\Users\Admin\AppData\Local\Temp\5e065fed8f698980d2d3a7733cb5a966.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\5e065fed8f698980d2d3a7733cb5a966.exe"C:\Users\Admin\AppData\Local\Temp\5e065fed8f698980d2d3a7733cb5a966.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF0E5.tmpFilesize
1KB
MD54c2e91f0b1d579c86e1ac40ab271dc80
SHA1fd6e650e3c950d10a95165cc062a003914f1c693
SHA256119644ff064066fa6fe1aa2568f7ea4b543c22c6b82023fee34310fdcdca2e79
SHA5129d56d245ef1a295826e95962c2570f95784c3d767c3ae57619ca7e91c23ef6ffde5f545d90453b0d0d4e7b7e916cb49de31a7863ec67538994274f21b0adc652
-
memory/648-60-0x0000000000000000-mapping.dmp
-
memory/960-55-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/960-56-0x0000000004210000-0x000000000422A000-memory.dmpFilesize
104KB
-
memory/960-57-0x00000000005C0000-0x00000000005CC000-memory.dmpFilesize
48KB
-
memory/960-58-0x0000000005370000-0x00000000053F8000-memory.dmpFilesize
544KB
-
memory/960-63-0x0000000005400000-0x000000000542E000-memory.dmpFilesize
184KB
-
memory/960-54-0x0000000000280000-0x0000000000352000-memory.dmpFilesize
840KB
-
memory/1344-79-0x000000006DBA0000-0x000000006E14B000-memory.dmpFilesize
5.7MB
-
memory/1344-59-0x0000000000000000-mapping.dmp
-
memory/1344-81-0x000000006DBA0000-0x000000006E14B000-memory.dmpFilesize
5.7MB
-
memory/1708-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-75-0x000000000040242D-mapping.dmp
-
memory/1708-78-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1708-82-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB