Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2022 07:12
Static task
static1
Behavioral task
behavioral1
Sample
6dfaae50e7e5e48997d3cd80e1355627.exe
Resource
win7-20220901-en
General
-
Target
6dfaae50e7e5e48997d3cd80e1355627.exe
-
Size
784KB
-
MD5
6dfaae50e7e5e48997d3cd80e1355627
-
SHA1
b6a2438f5f7543ed0733c620d9caa7f8fd0c8a39
-
SHA256
b0355698b9cac14e82f75a7b8cc8f49cfcf02e559f5122095cb7156eb44a0143
-
SHA512
1269a14448dfcb3c0b73ea4b96895ff5285388c31013c67cc9132fc3045507dff04f924afad92b44bdf78b8ddf13b450edd41e2671ba79484a859a0a710b66bf
-
SSDEEP
12288:vdFxQiJc0s+oRKrsY4jOfSK9f27k99jVX70oLZkg1YnZmSaCzLn0ZE4kri19X9:v9y0YKrajySK9ftPhX7DLZf6XLMkrYX
Malware Config
Extracted
netwire
212.193.30.230:3363
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@2
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1220-146-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1220-148-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1220-153-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6dfaae50e7e5e48997d3cd80e1355627.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 6dfaae50e7e5e48997d3cd80e1355627.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6dfaae50e7e5e48997d3cd80e1355627.exedescription pid process target process PID 3516 set thread context of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1792 powershell.exe 1792 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1792 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
6dfaae50e7e5e48997d3cd80e1355627.exedescription pid process target process PID 3516 wrote to memory of 1792 3516 6dfaae50e7e5e48997d3cd80e1355627.exe powershell.exe PID 3516 wrote to memory of 1792 3516 6dfaae50e7e5e48997d3cd80e1355627.exe powershell.exe PID 3516 wrote to memory of 1792 3516 6dfaae50e7e5e48997d3cd80e1355627.exe powershell.exe PID 3516 wrote to memory of 5032 3516 6dfaae50e7e5e48997d3cd80e1355627.exe schtasks.exe PID 3516 wrote to memory of 5032 3516 6dfaae50e7e5e48997d3cd80e1355627.exe schtasks.exe PID 3516 wrote to memory of 5032 3516 6dfaae50e7e5e48997d3cd80e1355627.exe schtasks.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe PID 3516 wrote to memory of 1220 3516 6dfaae50e7e5e48997d3cd80e1355627.exe 6dfaae50e7e5e48997d3cd80e1355627.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dfaae50e7e5e48997d3cd80e1355627.exe"C:\Users\Admin\AppData\Local\Temp\6dfaae50e7e5e48997d3cd80e1355627.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mYEZtzpxFOu.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mYEZtzpxFOu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5DEF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\6dfaae50e7e5e48997d3cd80e1355627.exe"C:\Users\Admin\AppData\Local\Temp\6dfaae50e7e5e48997d3cd80e1355627.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5DEF.tmpFilesize
1KB
MD55d012a7c7bc497ce85ac1d0361fc4e48
SHA1f1fab892a2dfb072ec380a4a1c46822dcdfad76e
SHA2561caa8d77a5d37149a3f8ce95df037c8cb8c4f4e3fa695c3a189e2b54dab7943d
SHA5120b42703fe33c21c502ad65c1dd3b4ff67a194fb2a65a23b9c0e2a0ef45ee382613a53601043c41dd9c6e04d59620005e52795bf3e9df60cc84ef9cc145ba7e33
-
memory/1220-153-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1220-148-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1220-146-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1220-145-0x0000000000000000-mapping.dmp
-
memory/1792-150-0x00000000054D0000-0x0000000005536000-memory.dmpFilesize
408KB
-
memory/1792-157-0x00000000074D0000-0x0000000007B4A000-memory.dmpFilesize
6.5MB
-
memory/1792-142-0x0000000000E00000-0x0000000000E36000-memory.dmpFilesize
216KB
-
memory/1792-140-0x0000000000000000-mapping.dmp
-
memory/1792-144-0x0000000004DF0000-0x0000000005418000-memory.dmpFilesize
6.2MB
-
memory/1792-163-0x00000000071C0000-0x00000000071C8000-memory.dmpFilesize
32KB
-
memory/1792-162-0x00000000071E0000-0x00000000071FA000-memory.dmpFilesize
104KB
-
memory/1792-161-0x00000000070D0000-0x00000000070DE000-memory.dmpFilesize
56KB
-
memory/1792-149-0x0000000004BD0000-0x0000000004BF2000-memory.dmpFilesize
136KB
-
memory/1792-160-0x0000000007120000-0x00000000071B6000-memory.dmpFilesize
600KB
-
memory/1792-151-0x0000000005540000-0x00000000055A6000-memory.dmpFilesize
408KB
-
memory/1792-152-0x0000000005B70000-0x0000000005B8E000-memory.dmpFilesize
120KB
-
memory/1792-159-0x0000000006F10000-0x0000000006F1A000-memory.dmpFilesize
40KB
-
memory/1792-154-0x0000000006140000-0x0000000006172000-memory.dmpFilesize
200KB
-
memory/1792-155-0x0000000070840000-0x000000007088C000-memory.dmpFilesize
304KB
-
memory/1792-156-0x0000000006120000-0x000000000613E000-memory.dmpFilesize
120KB
-
memory/1792-158-0x0000000006E90000-0x0000000006EAA000-memory.dmpFilesize
104KB
-
memory/3516-136-0x0000000005440000-0x00000000059E4000-memory.dmpFilesize
5.6MB
-
memory/3516-135-0x00000000002B0000-0x0000000000378000-memory.dmpFilesize
800KB
-
memory/3516-137-0x0000000004D30000-0x0000000004DC2000-memory.dmpFilesize
584KB
-
memory/3516-138-0x0000000004CF0000-0x0000000004CFA000-memory.dmpFilesize
40KB
-
memory/3516-139-0x0000000005D70000-0x0000000005E0C000-memory.dmpFilesize
624KB
-
memory/5032-141-0x0000000000000000-mapping.dmp