Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2022 01:34
Static task
static1
Behavioral task
behavioral1
Sample
a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe
Resource
win10v2004-20220812-en
General
-
Target
a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe
-
Size
261KB
-
MD5
b11998e748a73de0094e9c8a742225e6
-
SHA1
d7ec09cd52c1f0e2f6d21dfda48689d51b7a4840
-
SHA256
a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad
-
SHA512
210e60c67a5dca1376698e41df5ea7c483b5ca353e767d21405074bade4d44bcbf576ccb9437baba4ce9bc85bec8d963975a69c0286318232e2bc8793b935794
-
SSDEEP
6144:ZNJfAJdpbgneJK2BPqWOyJAGovjNcjat9w44mZ/M:STFgeE2BbOIrovjm+934U
Malware Config
Extracted
netwire
wealthymachine.ddns.net:39560
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
sunshineslisa
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4944-140-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/4944-142-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/4944-144-0x0000000000400000-0x0000000000420000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
Audio.exepid process 1512 Audio.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Audio.exe" a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Audio.exedescription pid process target process PID 1512 set thread context of 4944 1512 Audio.exe RegAsm.exe -
Drops file in Windows directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\.IgHiJkLiO RegAsm.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\.IgHiJkLiO RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exeAudio.exedescription pid process Token: SeDebugPrivilege 3036 a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe Token: SeDebugPrivilege 1512 Audio.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exeAudio.exedescription pid process target process PID 3036 wrote to memory of 1512 3036 a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe Audio.exe PID 3036 wrote to memory of 1512 3036 a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe Audio.exe PID 3036 wrote to memory of 1512 3036 a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe Audio.exe PID 1512 wrote to memory of 4944 1512 Audio.exe RegAsm.exe PID 1512 wrote to memory of 4944 1512 Audio.exe RegAsm.exe PID 1512 wrote to memory of 4944 1512 Audio.exe RegAsm.exe PID 1512 wrote to memory of 4944 1512 Audio.exe RegAsm.exe PID 1512 wrote to memory of 4944 1512 Audio.exe RegAsm.exe PID 1512 wrote to memory of 4944 1512 Audio.exe RegAsm.exe PID 1512 wrote to memory of 4944 1512 Audio.exe RegAsm.exe PID 1512 wrote to memory of 4944 1512 Audio.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe"C:\Users\Admin\AppData\Local\Temp\a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Audio.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Audio.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Audio.exeFilesize
261KB
MD5b11998e748a73de0094e9c8a742225e6
SHA1d7ec09cd52c1f0e2f6d21dfda48689d51b7a4840
SHA256a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad
SHA512210e60c67a5dca1376698e41df5ea7c483b5ca353e767d21405074bade4d44bcbf576ccb9437baba4ce9bc85bec8d963975a69c0286318232e2bc8793b935794
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Audio.exeFilesize
261KB
MD5b11998e748a73de0094e9c8a742225e6
SHA1d7ec09cd52c1f0e2f6d21dfda48689d51b7a4840
SHA256a86d9bb9ad2b22d6148329d45a59cbc27c7f3a8e65e8997fffda803b16f25fad
SHA512210e60c67a5dca1376698e41df5ea7c483b5ca353e767d21405074bade4d44bcbf576ccb9437baba4ce9bc85bec8d963975a69c0286318232e2bc8793b935794
-
memory/1512-133-0x0000000000000000-mapping.dmp
-
memory/1512-137-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/1512-139-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/1512-145-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/3036-132-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/3036-136-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/4944-138-0x0000000000000000-mapping.dmp
-
memory/4944-140-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4944-142-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4944-144-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB