Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 17:37
Static task
static1
Behavioral task
behavioral1
Sample
fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe
Resource
win10v2004-20220812-en
General
-
Target
fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe
-
Size
274KB
-
MD5
954a40569d9840fd4d492d19cc3fa5a6
-
SHA1
a3c6622bfbeef7023d5bbede041451e305124d02
-
SHA256
fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6
-
SHA512
e9a7b97647d10178a60a88c6310d49db2c10edab7ded53c63a8fe2f80d3af9be25b3525f58f2b808c84d73e8bbc8b3003953201456c107880be3bba695907d3c
-
SSDEEP
6144:bwwik3MHZNEDy756uTayLhvIZp9QTwtlSBtNCD3WQlGb1Y724shg+agT:bbikc5jTCSdj3cgT
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/552-136-0x0000000000400000-0x0000000000417000-memory.dmp netwire behavioral2/memory/4904-145-0x0000000000400000-0x0000000000417000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
ImgBurn.exeImgBurn.exepid process 4944 ImgBurn.exe 4904 ImgBurn.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ImgBurn.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ ImgBurn.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ImgBurn = "C:\\Users\\Admin\\AppData\\Roaming\\ImgBurn\\ImgBurn.exe" ImgBurn.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exeImgBurn.exedescription pid process target process PID 2400 set thread context of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 4944 set thread context of 4904 4944 ImgBurn.exe ImgBurn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exefd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exeImgBurn.exedescription pid process target process PID 2400 wrote to memory of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 2400 wrote to memory of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 2400 wrote to memory of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 2400 wrote to memory of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 2400 wrote to memory of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 2400 wrote to memory of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 2400 wrote to memory of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 2400 wrote to memory of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 2400 wrote to memory of 552 2400 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe PID 552 wrote to memory of 4944 552 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe ImgBurn.exe PID 552 wrote to memory of 4944 552 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe ImgBurn.exe PID 552 wrote to memory of 4944 552 fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe ImgBurn.exe PID 4944 wrote to memory of 4904 4944 ImgBurn.exe ImgBurn.exe PID 4944 wrote to memory of 4904 4944 ImgBurn.exe ImgBurn.exe PID 4944 wrote to memory of 4904 4944 ImgBurn.exe ImgBurn.exe PID 4944 wrote to memory of 4904 4944 ImgBurn.exe ImgBurn.exe PID 4944 wrote to memory of 4904 4944 ImgBurn.exe ImgBurn.exe PID 4944 wrote to memory of 4904 4944 ImgBurn.exe ImgBurn.exe PID 4944 wrote to memory of 4904 4944 ImgBurn.exe ImgBurn.exe PID 4944 wrote to memory of 4904 4944 ImgBurn.exe ImgBurn.exe PID 4944 wrote to memory of 4904 4944 ImgBurn.exe ImgBurn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe"C:\Users\Admin\AppData\Local\Temp\fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe"C:\Users\Admin\AppData\Local\Temp\fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Roaming\ImgBurn\ImgBurn.exe"C:\Users\Admin\AppData\Roaming\ImgBurn\ImgBurn.exe" -m C:\Users\Admin\AppData\Local\Temp\fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Roaming\ImgBurn\ImgBurn.exe"C:\Users\Admin\AppData\Roaming\ImgBurn\ImgBurn.exe" -m C:\Users\Admin\AppData\Local\Temp\fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4904
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ImgBurn\ImgBurn.exeFilesize
274KB
MD5954a40569d9840fd4d492d19cc3fa5a6
SHA1a3c6622bfbeef7023d5bbede041451e305124d02
SHA256fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6
SHA512e9a7b97647d10178a60a88c6310d49db2c10edab7ded53c63a8fe2f80d3af9be25b3525f58f2b808c84d73e8bbc8b3003953201456c107880be3bba695907d3c
-
C:\Users\Admin\AppData\Roaming\ImgBurn\ImgBurn.exeFilesize
274KB
MD5954a40569d9840fd4d492d19cc3fa5a6
SHA1a3c6622bfbeef7023d5bbede041451e305124d02
SHA256fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6
SHA512e9a7b97647d10178a60a88c6310d49db2c10edab7ded53c63a8fe2f80d3af9be25b3525f58f2b808c84d73e8bbc8b3003953201456c107880be3bba695907d3c
-
C:\Users\Admin\AppData\Roaming\ImgBurn\ImgBurn.exeFilesize
274KB
MD5954a40569d9840fd4d492d19cc3fa5a6
SHA1a3c6622bfbeef7023d5bbede041451e305124d02
SHA256fd1ddff4e361bc59e19399cae6bd9f9f81381a3480774d283ebfa01a3a9cc2f6
SHA512e9a7b97647d10178a60a88c6310d49db2c10edab7ded53c63a8fe2f80d3af9be25b3525f58f2b808c84d73e8bbc8b3003953201456c107880be3bba695907d3c
-
memory/552-132-0x0000000000000000-mapping.dmp
-
memory/552-133-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/552-134-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/552-135-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/552-136-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4904-140-0x0000000000000000-mapping.dmp
-
memory/4904-145-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4944-137-0x0000000000000000-mapping.dmp