Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 15:00
Static task
static1
Behavioral task
behavioral1
Sample
c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe
Resource
win7-20220812-en
General
-
Target
c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe
-
Size
91KB
-
MD5
e59eb3c46870c8331d40464d1dcacc34
-
SHA1
41deeee3508275807476fbb72e4aa7b8263c9362
-
SHA256
c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c
-
SHA512
d0878707e5e6dd1b8e9cee3bc4c6b8bdc4b949dc6fa1f9a8755809af6e504e3983760bbe66b663d19c582347fdaa8fac0994e60bcdbcd0b3952535a53b8856e3
-
SSDEEP
1536:18l0sr8wujP2zmj0IextvIgi647CDkxN9uO+1eEm/S38zNyA3JuQQ/r:1k04LE2z8teTIgFniN9S1goONLA
Malware Config
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-61-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1684-63-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1684-64-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/1684-67-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1684-68-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1684-77-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
PEVerify.exepid process 932 PEVerify.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1296 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exedescription pid process target process PID 1976 set thread context of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exePEVerify.exepid process 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe 932 PEVerify.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exePEVerify.exedescription pid process Token: SeDebugPrivilege 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe Token: SeDebugPrivilege 932 PEVerify.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.execmd.exedescription pid process target process PID 1976 wrote to memory of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe PID 1976 wrote to memory of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe PID 1976 wrote to memory of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe PID 1976 wrote to memory of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe PID 1976 wrote to memory of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe PID 1976 wrote to memory of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe PID 1976 wrote to memory of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe PID 1976 wrote to memory of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe PID 1976 wrote to memory of 1684 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe PID 1976 wrote to memory of 1296 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe cmd.exe PID 1976 wrote to memory of 1296 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe cmd.exe PID 1976 wrote to memory of 1296 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe cmd.exe PID 1976 wrote to memory of 1296 1976 c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe cmd.exe PID 1296 wrote to memory of 932 1296 cmd.exe PEVerify.exe PID 1296 wrote to memory of 932 1296 cmd.exe PEVerify.exe PID 1296 wrote to memory of 932 1296 cmd.exe PEVerify.exe PID 1296 wrote to memory of 932 1296 cmd.exe PEVerify.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe"C:\Users\Admin\AppData\Local\Temp\c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe"C:\Users\Admin\AppData\Local\Temp\c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\PEVerify.exe" "C:\Users\Admin\AppData\Local\Temp\c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe" & exit2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\PEVerify.exe"C:\Users\Admin\AppData\Roaming\PEVerify.exe" "C:\Users\Admin\AppData\Local\Temp\c605def48c1260429f668b322e679c9cfffe303eb3a3ce1e7cdd48ff2328807c.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\PEVerify.exeFilesize
10KB
MD59286123c291b2157b4a6b4be0644146f
SHA15d3358cb6164a468656012e1a331dd0e015f4f50
SHA256fbe24956f48d857265bade94c931409f0ffabdda2110909580936bb671777431
SHA512bb9a0daa3a12c55bc014eae3eaf69acf21bfb0fb9d5896acaf13cbbbfe389bcd8c0577a703c90249dc904c9e7bb2e95574053a716032d576904b98171ce053ec
-
C:\Users\Admin\AppData\Roaming\PEVerify.exeFilesize
10KB
MD59286123c291b2157b4a6b4be0644146f
SHA15d3358cb6164a468656012e1a331dd0e015f4f50
SHA256fbe24956f48d857265bade94c931409f0ffabdda2110909580936bb671777431
SHA512bb9a0daa3a12c55bc014eae3eaf69acf21bfb0fb9d5896acaf13cbbbfe389bcd8c0577a703c90249dc904c9e7bb2e95574053a716032d576904b98171ce053ec
-
\Users\Admin\AppData\Roaming\PEVerify.exeFilesize
10KB
MD59286123c291b2157b4a6b4be0644146f
SHA15d3358cb6164a468656012e1a331dd0e015f4f50
SHA256fbe24956f48d857265bade94c931409f0ffabdda2110909580936bb671777431
SHA512bb9a0daa3a12c55bc014eae3eaf69acf21bfb0fb9d5896acaf13cbbbfe389bcd8c0577a703c90249dc904c9e7bb2e95574053a716032d576904b98171ce053ec
-
memory/932-78-0x0000000074120000-0x00000000746CB000-memory.dmpFilesize
5.7MB
-
memory/932-75-0x0000000074120000-0x00000000746CB000-memory.dmpFilesize
5.7MB
-
memory/932-72-0x0000000000000000-mapping.dmp
-
memory/1296-69-0x0000000000000000-mapping.dmp
-
memory/1684-59-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1684-67-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1684-68-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1684-64-0x00000000004021DA-mapping.dmp
-
memory/1684-63-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1684-61-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1684-57-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1684-56-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1684-77-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1976-54-0x00000000754E1000-0x00000000754E3000-memory.dmpFilesize
8KB
-
memory/1976-76-0x0000000074120000-0x00000000746CB000-memory.dmpFilesize
5.7MB
-
memory/1976-55-0x0000000074120000-0x00000000746CB000-memory.dmpFilesize
5.7MB