Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 02:19
Behavioral task
behavioral1
Sample
newshipmentetasin.scr
Resource
win7-20220901-en
General
-
Target
newshipmentetasin.scr
-
Size
68KB
-
MD5
c9bcba025fadca6fc4fba568eef82b1d
-
SHA1
aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
-
SHA256
cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
-
SHA512
0fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
SSDEEP
1536:oJnrpcLAuel7XM0sXBnKSfzfcMCnouy8XKI7ehMHaa0CE:Srp6Arlux74outXKI7ehMHj8
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/916-67-0x0000000000400000-0x000000000041A000-memory.dmp netwire behavioral1/memory/344-79-0x0000000000400000-0x000000000041A000-memory.dmp netwire behavioral1/memory/1468-80-0x0000000000400000-0x000000000043F000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
AliAIM.exeAliAIM.exepid process 1468 AliAIM.exe 344 AliAIM.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
AliAIM.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{324AM7TA-223E-X5YI-XY1E-0QILY7E327K0} AliAIM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{324AM7TA-223E-X5YI-XY1E-0QILY7E327K0}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\AliAIM.exe\"" AliAIM.exe -
Processes:
resource yara_rule behavioral1/memory/916-56-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/992-59-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/916-61-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/916-62-0x0000000000400000-0x000000000041A000-memory.dmp upx \Users\Admin\AppData\Roaming\Install\AliAIM.exe upx behavioral1/memory/916-67-0x0000000000400000-0x000000000041A000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe upx \Users\Admin\AppData\Roaming\Install\AliAIM.exe upx behavioral1/memory/1468-70-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe upx C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe upx behavioral1/memory/344-79-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1468-80-0x0000000000400000-0x000000000043F000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
newshipmentetasin.scrpid process 916 newshipmentetasin.scr 916 newshipmentetasin.scr -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
AliAIM.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ AliAIM.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\AliAIMSoft = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\AliAIM.exe" AliAIM.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
newshipmentetasin.scrAliAIM.exedescription pid process target process PID 992 set thread context of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 1468 set thread context of 344 1468 AliAIM.exe AliAIM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
newshipmentetasin.scrAliAIM.exepid process 992 newshipmentetasin.scr 1468 AliAIM.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
newshipmentetasin.scrnewshipmentetasin.scrAliAIM.exedescription pid process target process PID 992 wrote to memory of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 992 wrote to memory of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 992 wrote to memory of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 992 wrote to memory of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 992 wrote to memory of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 992 wrote to memory of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 992 wrote to memory of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 992 wrote to memory of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 992 wrote to memory of 916 992 newshipmentetasin.scr newshipmentetasin.scr PID 916 wrote to memory of 1468 916 newshipmentetasin.scr AliAIM.exe PID 916 wrote to memory of 1468 916 newshipmentetasin.scr AliAIM.exe PID 916 wrote to memory of 1468 916 newshipmentetasin.scr AliAIM.exe PID 916 wrote to memory of 1468 916 newshipmentetasin.scr AliAIM.exe PID 1468 wrote to memory of 344 1468 AliAIM.exe AliAIM.exe PID 1468 wrote to memory of 344 1468 AliAIM.exe AliAIM.exe PID 1468 wrote to memory of 344 1468 AliAIM.exe AliAIM.exe PID 1468 wrote to memory of 344 1468 AliAIM.exe AliAIM.exe PID 1468 wrote to memory of 344 1468 AliAIM.exe AliAIM.exe PID 1468 wrote to memory of 344 1468 AliAIM.exe AliAIM.exe PID 1468 wrote to memory of 344 1468 AliAIM.exe AliAIM.exe PID 1468 wrote to memory of 344 1468 AliAIM.exe AliAIM.exe PID 1468 wrote to memory of 344 1468 AliAIM.exe AliAIM.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\newshipmentetasin.scr"C:\Users\Admin\AppData\Local\Temp\newshipmentetasin.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\newshipmentetasin.scr"C:\Users\Admin\AppData\Local\Temp\newshipmentetasin.scr"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe"C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe" -m C:\Users\Admin\AppData\Local\Temp\newshipmentetasin.scr3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe"C:\Users\Admin\AppData\Roaming\Install\AliAIM.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
C:\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
\Users\Admin\AppData\Roaming\Install\AliAIM.exeFilesize
68KB
MD5c9bcba025fadca6fc4fba568eef82b1d
SHA1aa2c6f346bcb4057c394c6c7fff6c925122e7e2b
SHA256cf0f08c4deb691e58a68c5bc502b5db89e3b07bb8fdad9db49938fcb6b86c578
SHA5120fa64c4cf91e3359ac5a26cfea84f621632964489030dd9d38bc61317f0055b1478dad6ba720f1eed2d3fe4e1d0a75a373665b554a80784fbb0416f138050f60
-
memory/344-79-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/344-73-0x00000000004183B0-mapping.dmp
-
memory/916-57-0x00000000004183B0-mapping.dmp
-
memory/916-67-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/916-60-0x0000000076561000-0x0000000076563000-memory.dmpFilesize
8KB
-
memory/916-62-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/916-56-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/916-61-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/992-59-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1468-65-0x0000000000000000-mapping.dmp
-
memory/1468-70-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1468-80-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB