Analysis
-
max time kernel
131s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-11-2022 18:20
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.exe
Resource
win7-20220812-en
General
-
Target
RFQ.exe
-
Size
7KB
-
MD5
97ebc55be1229c2fdec3edd582a4b7f5
-
SHA1
2d27e899704d74a88696c402f638f83d6b733f3e
-
SHA256
32ad4debd99aa2f13ce76dd248ff89710130e18e0427466179217256fba79357
-
SHA512
0517a5d48a70aa423f3a7e6cf215f67fd9f1d6c6273642ffbe2e64a901d3ec207ef267e156a59ee71b4a7eb7e95a04ff427a83ce75cdf706ed596e3e984512d5
-
SSDEEP
96:aXaIztK8DAKuxcDFlIdLfTXTWBkYPeDsOpDOxk7AVdbFRzNt:aXawo7KPKdLfykY2oOpDOi7ARz
Malware Config
Extracted
netwire
212.193.30.230:3363
212.193.30.230:3362
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Cantbeme@1
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/684-66-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/684-67-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/684-68-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/684-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/684-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/684-72-0x000000000040242D-mapping.dmp netwire behavioral1/memory/684-75-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/684-76-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ.exedescription pid process target process PID 1932 set thread context of 684 1932 RFQ.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 816 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ.exepowershell.exedescription pid process Token: SeDebugPrivilege 1932 RFQ.exe Token: SeDebugPrivilege 816 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
RFQ.exedescription pid process target process PID 1932 wrote to memory of 816 1932 RFQ.exe powershell.exe PID 1932 wrote to memory of 816 1932 RFQ.exe powershell.exe PID 1932 wrote to memory of 816 1932 RFQ.exe powershell.exe PID 1932 wrote to memory of 816 1932 RFQ.exe powershell.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe PID 1932 wrote to memory of 684 1932 RFQ.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵PID:684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/684-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/684-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/684-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/684-76-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/684-66-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/684-75-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/684-61-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/684-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/684-72-0x000000000040242D-mapping.dmp
-
memory/684-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/684-62-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-60-0x000000006E2E0000-0x000000006E88B000-memory.dmpFilesize
5.7MB
-
memory/816-59-0x000000006E2E0000-0x000000006E88B000-memory.dmpFilesize
5.7MB
-
memory/816-57-0x0000000000000000-mapping.dmp
-
memory/1932-54-0x00000000000B0000-0x00000000000B8000-memory.dmpFilesize
32KB
-
memory/1932-56-0x000000000A020000-0x000000000A24A000-memory.dmpFilesize
2.2MB
-
memory/1932-55-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB