Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21-10-2022 15:41
Static task
static1
Behavioral task
behavioral1
Sample
be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
Resource
win10v2004-20220812-en
General
-
Target
be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
-
Size
143KB
-
MD5
7146fadada85da5c561b6a5db6593c50
-
SHA1
7ddb7a384785c1fc830d36df9b424c1b9172ae78
-
SHA256
be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d
-
SHA512
3db8eb689c9f95bb3ac705242d15188c73a2498a04f728eb73e16af00cc03b828afb8e0ac2630f9201bee57189f0c1c3bfef650871fb09e5929ec6b27dd83d04
-
SSDEEP
3072:HAsj8MBX8s0oXJn45tph2Zp6GyNuBvjelAqx7NNST1/0+O:HAsBZlan2ZIIhelAql21/0+O
Malware Config
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/892-64-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/892-66-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/892-67-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/892-70-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/892-71-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Loads dropped DLL 2 IoCs
Processes:
be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exepid process 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowsdating = "C:\\Users\\Admin\\AppData\\Local\\Temp\\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe" be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exedescription pid process target process PID 1104 set thread context of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exedescription pid process target process PID 1104 wrote to memory of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe PID 1104 wrote to memory of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe PID 1104 wrote to memory of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe PID 1104 wrote to memory of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe PID 1104 wrote to memory of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe PID 1104 wrote to memory of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe PID 1104 wrote to memory of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe PID 1104 wrote to memory of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe PID 1104 wrote to memory of 892 1104 be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe"C:\Users\Admin\AppData\Local\Temp\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe"C:\Users\Admin\AppData\Local\Temp\be4fbafdadafb2cba3fb049c60366d5e063585153e5345a618e37528f401443d.exe"2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\catnips.dllFilesize
64KB
MD5d4c4fd18b18f198868635ed49d313429
SHA1abc0edf259654aa4a5709a331091e5c351388966
SHA256a5143753449c03d36308d9e9a799d6bd3e2bb02a601c90ff145acf3942b1e30b
SHA5129b068ab27c3c1aad766eb56cc38b1abf1d995209455c396531e3d0dc62cb49e2df28f98b4249e8afeb6bdc9ae7c3207ad014c9267630c0d47df9ed6d9a265943
-
\Users\Admin\AppData\Local\Temp\nst480B.tmp\System.dllFilesize
11KB
MD5883eff06ac96966270731e4e22817e11
SHA1523c87c98236cbc04430e87ec19b977595092ac8
SHA25644e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA51260333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
-
memory/892-59-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/892-60-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/892-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/892-64-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/892-66-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/892-67-0x00000000004021DA-mapping.dmp
-
memory/892-70-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/892-71-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmpFilesize
8KB
-
memory/1104-57-0x0000000000330000-0x0000000000341000-memory.dmpFilesize
68KB