Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 23:03
Static task
static1
Behavioral task
behavioral1
Sample
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
Resource
win7-20220812-en
General
-
Target
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe
-
Size
806KB
-
MD5
aa8ac68af525eb1805fd80d36390524f
-
SHA1
fa2aec1760fe268813de00e4dbb2a6fb4f06e973
-
SHA256
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac
-
SHA512
ae7ecb9c33cfab7588aaf7af498a500c2d532febf257407abd95c6d88cfeb18b3e1cacf96e15d224a11c824e623e957fc381d36f5fdb96e3892f643cad8a5c41
-
SSDEEP
12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a0nRBMvJ2dHsabd:5RmJkcoQricOIQxiZY1ia0nRBMkdd
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3180-145-0x0000000000400000-0x0000000000422000-memory.dmp netwire behavioral2/memory/3180-147-0x0000000000400000-0x0000000000422000-memory.dmp netwire -
Processes:
resource yara_rule behavioral2/memory/4608-135-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/4608-137-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/4608-138-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/3180-142-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/3180-144-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/3180-145-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4608-146-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/3180-147-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe -
Drops startup file 1 IoCs
Processes:
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exevbc.exedescription pid process target process PID 3320 set thread context of 4608 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe vbc.exe PID 4608 set thread context of 3180 4608 vbc.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
vbc.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier vbc.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exevbc.exepid process 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 4608 vbc.exe 4608 vbc.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exepid process 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exepid process 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 4608 vbc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exevbc.exedescription pid process target process PID 4844 wrote to memory of 3320 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe PID 4844 wrote to memory of 3320 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe PID 4844 wrote to memory of 3320 4844 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe PID 3320 wrote to memory of 4608 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe vbc.exe PID 3320 wrote to memory of 4608 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe vbc.exe PID 3320 wrote to memory of 4608 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe vbc.exe PID 3320 wrote to memory of 4608 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe vbc.exe PID 3320 wrote to memory of 4608 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe vbc.exe PID 3320 wrote to memory of 4608 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe vbc.exe PID 3320 wrote to memory of 4608 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe vbc.exe PID 3320 wrote to memory of 4608 3320 9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe vbc.exe PID 4608 wrote to memory of 3180 4608 vbc.exe vbc.exe PID 4608 wrote to memory of 3180 4608 vbc.exe vbc.exe PID 4608 wrote to memory of 3180 4608 vbc.exe vbc.exe PID 4608 wrote to memory of 3180 4608 vbc.exe vbc.exe PID 4608 wrote to memory of 3180 4608 vbc.exe vbc.exe PID 4608 wrote to memory of 3180 4608 vbc.exe vbc.exe PID 4608 wrote to memory of 3180 4608 vbc.exe vbc.exe PID 4608 wrote to memory of 3180 4608 vbc.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe"C:\Users\Admin\AppData\Local\Temp\9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe"C:\Users\Admin\AppData\Local\Temp\9deb011f2a31263ebdb05daecd84d4362005cea1dfce65dc6f077b094f9435ac.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\data.bin"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\data.binFilesize
192KB
MD50b9aa95f5021d040058ab434b2b5cf03
SHA189e31979fa95ab2ef6222e94e2994d068d981dfe
SHA256c7b801b99dea3571944dcf51d9ada783597703117bf0c20c64add548ecf0a308
SHA512fd66794edb83e09a1ca743b926e989c87b3b447c2a07225ece2d5944f136c8248c3417e5319306f3645035e590667fdc71164b7b7d4c0ce4b606f206da3523a6
-
memory/3180-142-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3180-141-0x0000000000000000-mapping.dmp
-
memory/3180-144-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3180-145-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3180-147-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3320-132-0x0000000000000000-mapping.dmp
-
memory/4608-134-0x0000000000000000-mapping.dmp
-
memory/4608-135-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4608-137-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4608-138-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4608-146-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB