Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2022 08:31
Static task
static1
Behavioral task
behavioral1
Sample
22ce18519278ff29a5be2234046ab841.exe
Resource
win7-20220812-en
General
-
Target
22ce18519278ff29a5be2234046ab841.exe
-
Size
1009KB
-
MD5
22ce18519278ff29a5be2234046ab841
-
SHA1
55bc3eef779242d725b1e714b68b3af0ab2c9dc4
-
SHA256
a21c8ef38b35eda08af936729863498ead8f750de997bc2d55ff9da429872e33
-
SHA512
5c593a302296201c195772e350ef652087e5064833b3562523000fd6b4ded2fa0fb387eece3bde95ccf7918e091b5aa3a55ccb15401912ac13c597c6aeea79c0
-
SSDEEP
24576:OxU9yhM92fhwRIcseNhxZlmF14/H/TMEVoCN:mhMofmueNk+fTMioC
Malware Config
Extracted
netwire
212.193.30.230:3363
212.193.30.230:3362
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Cantbeme@1
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3888-143-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3888-145-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3888-149-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3888-161-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
22ce18519278ff29a5be2234046ab841.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 22ce18519278ff29a5be2234046ab841.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
22ce18519278ff29a5be2234046ab841.exedescription pid process target process PID 720 set thread context of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2692 powershell.exe 2692 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2692 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
22ce18519278ff29a5be2234046ab841.exedescription pid process target process PID 720 wrote to memory of 2692 720 22ce18519278ff29a5be2234046ab841.exe powershell.exe PID 720 wrote to memory of 2692 720 22ce18519278ff29a5be2234046ab841.exe powershell.exe PID 720 wrote to memory of 2692 720 22ce18519278ff29a5be2234046ab841.exe powershell.exe PID 720 wrote to memory of 4428 720 22ce18519278ff29a5be2234046ab841.exe schtasks.exe PID 720 wrote to memory of 4428 720 22ce18519278ff29a5be2234046ab841.exe schtasks.exe PID 720 wrote to memory of 4428 720 22ce18519278ff29a5be2234046ab841.exe schtasks.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe PID 720 wrote to memory of 3888 720 22ce18519278ff29a5be2234046ab841.exe 22ce18519278ff29a5be2234046ab841.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22ce18519278ff29a5be2234046ab841.exe"C:\Users\Admin\AppData\Local\Temp\22ce18519278ff29a5be2234046ab841.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vbbmTzmCj.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vbbmTzmCj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F21.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\22ce18519278ff29a5be2234046ab841.exe"C:\Users\Admin\AppData\Local\Temp\22ce18519278ff29a5be2234046ab841.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1F21.tmpFilesize
1KB
MD569579f37699655a5a847323b46b2622a
SHA147652cb88e4f9576a2959ab407c41fd155d1d81c
SHA2565d214bdaffdfffa26a42069ac311191d40d721542dbc6f01da1e4c667e3eb643
SHA512762a981a48697b4a5cb5050de81458a33231555206f2cfa72a42a7c21b4b58f21feb7a1b44f08bc9b0d719fdf4264a6b8e4c4925aeddbf1e8a6cc61777a3d1f8
-
memory/720-133-0x0000000005D10000-0x00000000062B4000-memory.dmpFilesize
5.6MB
-
memory/720-134-0x0000000005760000-0x00000000057F2000-memory.dmpFilesize
584KB
-
memory/720-135-0x0000000005740000-0x000000000574A000-memory.dmpFilesize
40KB
-
memory/720-136-0x00000000078D0000-0x000000000796C000-memory.dmpFilesize
624KB
-
memory/720-132-0x0000000000C80000-0x0000000000D82000-memory.dmpFilesize
1.0MB
-
memory/2692-147-0x0000000005450000-0x00000000054B6000-memory.dmpFilesize
408KB
-
memory/2692-155-0x0000000006E40000-0x0000000006E5A000-memory.dmpFilesize
104KB
-
memory/2692-160-0x0000000007160000-0x0000000007168000-memory.dmpFilesize
32KB
-
memory/2692-142-0x0000000004C70000-0x0000000005298000-memory.dmpFilesize
6.2MB
-
memory/2692-159-0x0000000007180000-0x000000000719A000-memory.dmpFilesize
104KB
-
memory/2692-158-0x0000000007070000-0x000000000707E000-memory.dmpFilesize
56KB
-
memory/2692-157-0x00000000070C0000-0x0000000007156000-memory.dmpFilesize
600KB
-
memory/2692-146-0x0000000004A60000-0x0000000004A82000-memory.dmpFilesize
136KB
-
memory/2692-137-0x0000000000000000-mapping.dmp
-
memory/2692-148-0x00000000054C0000-0x0000000005526000-memory.dmpFilesize
408KB
-
memory/2692-156-0x0000000006EB0000-0x0000000006EBA000-memory.dmpFilesize
40KB
-
memory/2692-150-0x0000000005B30000-0x0000000005B4E000-memory.dmpFilesize
120KB
-
memory/2692-151-0x0000000006100000-0x0000000006132000-memory.dmpFilesize
200KB
-
memory/2692-152-0x0000000070C70000-0x0000000070CBC000-memory.dmpFilesize
304KB
-
memory/2692-153-0x00000000060E0000-0x00000000060FE000-memory.dmpFilesize
120KB
-
memory/2692-154-0x0000000007480000-0x0000000007AFA000-memory.dmpFilesize
6.5MB
-
memory/2692-139-0x0000000004580000-0x00000000045B6000-memory.dmpFilesize
216KB
-
memory/3888-149-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3888-145-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3888-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3888-141-0x0000000000000000-mapping.dmp
-
memory/3888-161-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4428-138-0x0000000000000000-mapping.dmp