Analysis
-
max time kernel
187s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 02:01
Static task
static1
Behavioral task
behavioral1
Sample
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe
Resource
win7-20220812-en
General
-
Target
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe
-
Size
806KB
-
MD5
4fd6408ed28576790741bafdd1fcab49
-
SHA1
e17713b3e2751288bb12e16e4b45d95593faeb38
-
SHA256
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d
-
SHA512
ab3894fdf60f01529c44f4b27784ac8963f2df3e9589d15603a5417c88dc83b5ae31a09a17cf6eada2e3907b36317670f8ce8c8a61b2afe83bf777e096256558
-
SSDEEP
12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a5evi/r9xbcrLQWw0D8:5RmJkcoQricOIQxiZY1ia5eOEQW3D8
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1632-146-0x0000000000400000-0x0000000000422000-memory.dmp netwire behavioral2/memory/1632-147-0x0000000000400000-0x0000000000422000-memory.dmp netwire -
Processes:
resource yara_rule behavioral2/memory/4492-135-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/4492-137-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/4492-138-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/4492-141-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/1632-143-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/1632-145-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/1632-146-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/1632-147-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exevbc.exedescription pid process target process PID 2232 set thread context of 4492 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 4492 set thread context of 1632 4492 vbc.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
vbc.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier vbc.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exevbc.exepid process 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4492 vbc.exe 4492 vbc.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exepid process 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe -
Suspicious use of SendNotifyMessage 26 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exepid process 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 4492 vbc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exevbc.exedescription pid process target process PID 4880 wrote to memory of 2232 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe PID 4880 wrote to memory of 2232 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe PID 4880 wrote to memory of 2232 4880 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe PID 2232 wrote to memory of 4492 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 2232 wrote to memory of 4492 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 2232 wrote to memory of 4492 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 2232 wrote to memory of 4492 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 2232 wrote to memory of 4492 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 2232 wrote to memory of 4492 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 2232 wrote to memory of 4492 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 2232 wrote to memory of 4492 2232 33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe vbc.exe PID 4492 wrote to memory of 1632 4492 vbc.exe vbc.exe PID 4492 wrote to memory of 1632 4492 vbc.exe vbc.exe PID 4492 wrote to memory of 1632 4492 vbc.exe vbc.exe PID 4492 wrote to memory of 1632 4492 vbc.exe vbc.exe PID 4492 wrote to memory of 1632 4492 vbc.exe vbc.exe PID 4492 wrote to memory of 1632 4492 vbc.exe vbc.exe PID 4492 wrote to memory of 1632 4492 vbc.exe vbc.exe PID 4492 wrote to memory of 1632 4492 vbc.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe"C:\Users\Admin\AppData\Local\Temp\33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe"C:\Users\Admin\AppData\Local\Temp\33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\data.bin"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\data.binFilesize
192KB
MD59e72e0bfcae3af5a7662337446668a85
SHA1b3ac513826d576808ba0ce32459edaee722690ef
SHA256dd7f503567ba48e8aba0dd13169086d927a1f2baf7e0a870645c65039e051241
SHA5122e4972f66902391d58e1ffe73cee9d21fc40c29e6dbaaca39624ec2c96f3b8202f1497e891cf54dd00bced94baa8aaf3006e10a2fd9e235326e2ca30b6a3e2f7
-
memory/1632-143-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1632-142-0x0000000000000000-mapping.dmp
-
memory/1632-145-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1632-146-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1632-147-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2232-132-0x0000000000000000-mapping.dmp
-
memory/4492-134-0x0000000000000000-mapping.dmp
-
memory/4492-135-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4492-137-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4492-138-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4492-141-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB