Analysis
-
max time kernel
179s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 02:01
Static task
static1
Behavioral task
behavioral1
Sample
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe
Resource
win7-20220812-en
General
-
Target
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe
-
Size
806KB
-
MD5
4fd6408ed28576790741bafdd1fcab49
-
SHA1
e17713b3e2751288bb12e16e4b45d95593faeb38
-
SHA256
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d
-
SHA512
ab3894fdf60f01529c44f4b27784ac8963f2df3e9589d15603a5417c88dc83b5ae31a09a17cf6eada2e3907b36317670f8ce8c8a61b2afe83bf777e096256558
-
SSDEEP
12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a5evi/r9xbcrLQWw0D8:5RmJkcoQricOIQxiZY1ia5eOEQW3D8
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1432-80-0x0000000000400000-0x0000000000422000-memory.dmp netwire behavioral1/memory/1432-81-0x0000000000400000-0x0000000000422000-memory.dmp netwire -
Processes:
resource yara_rule behavioral1/memory/856-59-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/856-62-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/856-61-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/856-65-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/856-66-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1432-71-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/1432-73-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/1432-74-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/1432-78-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/856-79-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1432-80-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/1432-81-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exevbc.exedescription pid process target process PID 1512 set thread context of 856 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 856 set thread context of 1432 856 vbc.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
vbc.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier vbc.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exevbc.exepid process 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 856 vbc.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exepid process 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exepid process 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 856 vbc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exevbc.exedescription pid process target process PID 1940 wrote to memory of 1512 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe PID 1940 wrote to memory of 1512 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe PID 1940 wrote to memory of 1512 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe PID 1940 wrote to memory of 1512 1940 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe PID 1512 wrote to memory of 856 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 1512 wrote to memory of 856 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 1512 wrote to memory of 856 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 1512 wrote to memory of 856 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 1512 wrote to memory of 856 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 1512 wrote to memory of 856 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 1512 wrote to memory of 856 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 1512 wrote to memory of 856 1512 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 856 wrote to memory of 1432 856 vbc.exe vbc.exe PID 856 wrote to memory of 1432 856 vbc.exe vbc.exe PID 856 wrote to memory of 1432 856 vbc.exe vbc.exe PID 856 wrote to memory of 1432 856 vbc.exe vbc.exe PID 856 wrote to memory of 1432 856 vbc.exe vbc.exe PID 856 wrote to memory of 1432 856 vbc.exe vbc.exe PID 856 wrote to memory of 1432 856 vbc.exe vbc.exe PID 856 wrote to memory of 1432 856 vbc.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe"C:\Users\Admin\AppData\Local\Temp\33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe"C:\Users\Admin\AppData\Local\Temp\33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\data.bin"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\data.binFilesize
192KB
MD59e72e0bfcae3af5a7662337446668a85
SHA1b3ac513826d576808ba0ce32459edaee722690ef
SHA256dd7f503567ba48e8aba0dd13169086d927a1f2baf7e0a870645c65039e051241
SHA5122e4972f66902391d58e1ffe73cee9d21fc40c29e6dbaaca39624ec2c96f3b8202f1497e891cf54dd00bced94baa8aaf3006e10a2fd9e235326e2ca30b6a3e2f7
-
memory/856-65-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/856-58-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/856-66-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/856-79-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/856-62-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/856-61-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/856-63-0x0000000000457810-mapping.dmp
-
memory/856-59-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1432-81-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1432-73-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1432-75-0x000000000041FFA0-mapping.dmp
-
memory/1432-74-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1432-78-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1432-71-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1432-80-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1432-70-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1512-55-0x0000000000000000-mapping.dmp
-
memory/1940-54-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB