Analysis
-
max time kernel
151s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2022 11:09
Static task
static1
Behavioral task
behavioral1
Sample
895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
Resource
win10v2004-20220812-en
General
-
Target
895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
-
Size
138KB
-
MD5
77dfe5880ce35fe13c0f50a142ab8907
-
SHA1
e87635becb3234776d8e70e89cdd1669cae33e37
-
SHA256
895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f
-
SHA512
cd157579223e86a3c3d9e2ef88ab87f558801cd8cac947242338e09493826e7777465384f594471f44087422fcd3b3fcdf5ed0dc2df2b023e5fc815f000eb5d4
-
SSDEEP
3072:bAsj8MBX8s0oXJn45Hy381mrQ3cPSgWq1SLrsDBL5EGrDx4d4:bAsBZd8Y8gUAs+DBdY4
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1460-135-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/1460-137-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/1460-138-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Loads dropped DLL 2 IoCs
Processes:
895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exepid process 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe" 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exedescription pid process target process PID 4456 set thread context of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exedescription pid process target process PID 4456 wrote to memory of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe PID 4456 wrote to memory of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe PID 4456 wrote to memory of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe PID 4456 wrote to memory of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe PID 4456 wrote to memory of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe PID 4456 wrote to memory of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe PID 4456 wrote to memory of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe PID 4456 wrote to memory of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe PID 4456 wrote to memory of 1460 4456 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe 895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe"C:\Users\Admin\AppData\Local\Temp\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe"C:\Users\Admin\AppData\Local\Temp\895eb1a84c9ea5ba41e7a044cd4d53ff30c81c5fbf11284d44400f12cf3e012f.exe"2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\farness.dllFilesize
70KB
MD55ae14056745d7c103b412645fb8e71cf
SHA18be10a68e7e0fb98c247b3655afedafcbb6a52a7
SHA25655d0cb156c35836a52d6276021f4fedb8022240c4903fdd4a3e444c06ab5ec1a
SHA51287a334a09a38de95ca532ef9bda40836a29eeb81267bd9b906e9ad8d3f85f779e3e87d5e136e841b160d6ac5da63502d80a016d3451ba3f0640d431de47e2ff8
-
C:\Users\Admin\AppData\Local\Temp\nsrA356.tmp\System.dllFilesize
11KB
MD5883eff06ac96966270731e4e22817e11
SHA1523c87c98236cbc04430e87ec19b977595092ac8
SHA25644e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA51260333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
-
memory/1460-134-0x0000000000000000-mapping.dmp
-
memory/1460-135-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1460-137-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1460-138-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB