Analysis
-
max time kernel
65s -
max time network
112s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-11-2022 06:56
Static task
static1
Behavioral task
behavioral1
Sample
QPwk4Ce4nVKKJQn.exe
Resource
win7-20220901-en
General
-
Target
QPwk4Ce4nVKKJQn.exe
-
Size
695KB
-
MD5
d36407b9ed921fc741470dd033b316c9
-
SHA1
a7ac1ce53c2387d2bf05cf4e306f8bf95001e4f9
-
SHA256
1f8b6ebc0fbdb35c0b214652b69360c8dd78b569c9af9c1b355dd11f277624e2
-
SHA512
bb4e1f17a50b102497a09e77038d5201494317109ff91afc34ac4f35671161418e09e907624507ef72c1054e5bbd6934253fcf2c7c1f109c27fd469efc6fec77
-
SSDEEP
12288:jJwhuJLeujoAwiNXh+xQeLLr2TtQ0uSvUtuyXW3GOxq8eEQvhzps7:jKuJL/oAwUh+xLLr45vUg4y9qz7s7
Malware Config
Extracted
netwire
212.193.30.230:3367
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Telkomsa@1980
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/940-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/940-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/940-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/940-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/940-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/940-75-0x000000000040242D-mapping.dmp netwire behavioral1/memory/940-78-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/940-79-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/940-82-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
QPwk4Ce4nVKKJQn.exedescription pid process target process PID 960 set thread context of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 576 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 576 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
QPwk4Ce4nVKKJQn.exedescription pid process target process PID 960 wrote to memory of 576 960 QPwk4Ce4nVKKJQn.exe powershell.exe PID 960 wrote to memory of 576 960 QPwk4Ce4nVKKJQn.exe powershell.exe PID 960 wrote to memory of 576 960 QPwk4Ce4nVKKJQn.exe powershell.exe PID 960 wrote to memory of 576 960 QPwk4Ce4nVKKJQn.exe powershell.exe PID 960 wrote to memory of 512 960 QPwk4Ce4nVKKJQn.exe schtasks.exe PID 960 wrote to memory of 512 960 QPwk4Ce4nVKKJQn.exe schtasks.exe PID 960 wrote to memory of 512 960 QPwk4Ce4nVKKJQn.exe schtasks.exe PID 960 wrote to memory of 512 960 QPwk4Ce4nVKKJQn.exe schtasks.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe PID 960 wrote to memory of 940 960 QPwk4Ce4nVKKJQn.exe QPwk4Ce4nVKKJQn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QPwk4Ce4nVKKJQn.exe"C:\Users\Admin\AppData\Local\Temp\QPwk4Ce4nVKKJQn.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VAwjtSzxrjkA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VAwjtSzxrjkA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA851.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QPwk4Ce4nVKKJQn.exe"C:\Users\Admin\AppData\Local\Temp\QPwk4Ce4nVKKJQn.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA851.tmpFilesize
1KB
MD5b0824824689b4ce1fa23206f7a246afd
SHA19a829fbc99e5051393d96787fae764890a161d52
SHA2562b3581e993d9e9bbdb632653f2dc649ca65705f5cf7c582831bce260f21c2fa7
SHA512263d09be08cccd30b737b8e1113908a78f717ec34405c9d5a3889e2076267610cc6a4bb58579a98605019f0c8b1012749bce348b8edfee9e1aa0298123596da3
-
memory/512-60-0x0000000000000000-mapping.dmp
-
memory/576-59-0x0000000000000000-mapping.dmp
-
memory/576-81-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/576-80-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/940-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-78-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-82-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-79-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-75-0x000000000040242D-mapping.dmp
-
memory/940-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/940-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/960-54-0x0000000000210000-0x00000000002C4000-memory.dmpFilesize
720KB
-
memory/960-58-0x0000000004B00000-0x0000000004B7E000-memory.dmpFilesize
504KB
-
memory/960-63-0x0000000005510000-0x0000000005556000-memory.dmpFilesize
280KB
-
memory/960-56-0x0000000000880000-0x000000000089A000-memory.dmpFilesize
104KB
-
memory/960-55-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/960-57-0x0000000000B30000-0x0000000000B3C000-memory.dmpFilesize
48KB