Analysis
-
max time kernel
205s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 02:19
Behavioral task
behavioral1
Sample
cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe
Resource
win7-20221111-en
General
-
Target
cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe
-
Size
68KB
-
MD5
c9bcba025fadca6fc4fba568eef82b1d
-
SHA1
aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
-
SHA256
cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
-
SHA512
0fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
SSDEEP
1536:oJnrpcLAuel7XM0sXBnKSfzfcMCnouy8XKI7ehMHaa0CE:Srp6Arlux74outXKI7ehMHj8
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/768-64-0x0000000000400000-0x000000000041A000-memory.dmp netwire behavioral1/memory/476-80-0x0000000000400000-0x000000000041A000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
AliAIM.exeAliAIM.exepid process 572 AliAIM.exe 476 AliAIM.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
AliAIM.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{324AM7TA-223E-X5YI-XY1E-0QILY7E327K0} AliAIM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{324AM7TA-223E-X5YI-XY1E-0QILY7E327K0}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\AliAIM.exe\"" AliAIM.exe -
Processes:
resource yara_rule behavioral1/memory/1056-56-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1056-60-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/768-57-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/768-62-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/768-63-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/768-64-0x0000000000400000-0x000000000041A000-memory.dmp upx \Users\Admin\AppData\Roaming\Install\AliAIM.exe upx \Users\Admin\AppData\Roaming\Install\AliAIM.exe upx C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe upx C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe upx behavioral1/memory/572-76-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe upx behavioral1/memory/476-80-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exepid process 768 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe 768 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
AliAIM.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ AliAIM.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\AliAIMSoft = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\AliAIM.exe" AliAIM.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exeAliAIM.exedescription pid process target process PID 1056 set thread context of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 572 set thread context of 476 572 AliAIM.exe AliAIM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exeAliAIM.exepid process 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe 572 AliAIM.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.execf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exeAliAIM.exedescription pid process target process PID 1056 wrote to memory of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 1056 wrote to memory of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 1056 wrote to memory of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 1056 wrote to memory of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 1056 wrote to memory of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 1056 wrote to memory of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 1056 wrote to memory of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 1056 wrote to memory of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 1056 wrote to memory of 768 1056 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe PID 768 wrote to memory of 572 768 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe AliAIM.exe PID 768 wrote to memory of 572 768 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe AliAIM.exe PID 768 wrote to memory of 572 768 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe AliAIM.exe PID 768 wrote to memory of 572 768 cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe AliAIM.exe PID 572 wrote to memory of 476 572 AliAIM.exe AliAIM.exe PID 572 wrote to memory of 476 572 AliAIM.exe AliAIM.exe PID 572 wrote to memory of 476 572 AliAIM.exe AliAIM.exe PID 572 wrote to memory of 476 572 AliAIM.exe AliAIM.exe PID 572 wrote to memory of 476 572 AliAIM.exe AliAIM.exe PID 572 wrote to memory of 476 572 AliAIM.exe AliAIM.exe PID 572 wrote to memory of 476 572 AliAIM.exe AliAIM.exe PID 572 wrote to memory of 476 572 AliAIM.exe AliAIM.exe PID 572 wrote to memory of 476 572 AliAIM.exe AliAIM.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe"C:\Users\Admin\AppData\Local\Temp\cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe"C:\Users\Admin\AppData\Local\Temp\cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe"C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe" -m C:\Users\Admin\AppData\Local\Temp\cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe"C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
memory/476-80-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/476-73-0x00000000004183B0-mapping.dmp
-
memory/572-67-0x0000000000000000-mapping.dmp
-
memory/572-76-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/768-64-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/768-61-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/768-57-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/768-63-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/768-58-0x00000000004183B0-mapping.dmp
-
memory/768-62-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1056-56-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1056-60-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB