Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 04:55
Static task
static1
Behavioral task
behavioral1
Sample
bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe
Resource
win7-20220812-en
General
-
Target
bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe
-
Size
194KB
-
MD5
3ec662d3e6a70da2a026951a987e4425
-
SHA1
37fa066e35cdbeae7fb2ef13529097b971773725
-
SHA256
bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02
-
SHA512
6e9b5e74aa8e569a2d30ae15f00131d37bdfc97ebf5dc78fca59e83f9188381f0b122fe462d7808bbcb7c2796b83a5bbb4691fcf2d46692d50a5782f452888e3
-
SSDEEP
6144:r9Xuji6hAheEsKL0PUmXruVSGGfFu3FZu:VreEpgGSIg
Malware Config
Signatures
-
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1612-63-0x0000000000400000-0x000000000041A000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
Tcpview.exepid process 1860 Tcpview.exe -
Processes:
resource yara_rule behavioral1/memory/1612-56-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1612-57-0x00000000001C0000-0x00000000001C9000-memory.dmp upx behavioral1/memory/1612-58-0x0000000000400000-0x0000000000834000-memory.dmp upx behavioral1/memory/1612-63-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1860-66-0x0000000000400000-0x0000000000834000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exepid process 1612 bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe 1612 bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Tcpview.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Tcpview.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\TCPview\\Tcpview.exe" Tcpview.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of UnmapMainImage 2 IoCs
Processes:
bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exeTcpview.exepid process 1612 bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe 1860 Tcpview.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exedescription pid process target process PID 1612 wrote to memory of 1860 1612 bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe Tcpview.exe PID 1612 wrote to memory of 1860 1612 bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe Tcpview.exe PID 1612 wrote to memory of 1860 1612 bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe Tcpview.exe PID 1612 wrote to memory of 1860 1612 bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe Tcpview.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe"C:\Users\Admin\AppData\Local\Temp\bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TCPview\Tcpview.exe"C:\Users\Admin\AppData\Roaming\TCPview\Tcpview.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\TCPview\Tcpview.exeFilesize
194KB
MD53ec662d3e6a70da2a026951a987e4425
SHA137fa066e35cdbeae7fb2ef13529097b971773725
SHA256bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02
SHA5126e9b5e74aa8e569a2d30ae15f00131d37bdfc97ebf5dc78fca59e83f9188381f0b122fe462d7808bbcb7c2796b83a5bbb4691fcf2d46692d50a5782f452888e3
-
\Users\Admin\AppData\Roaming\TCPview\Tcpview.exeFilesize
194KB
MD53ec662d3e6a70da2a026951a987e4425
SHA137fa066e35cdbeae7fb2ef13529097b971773725
SHA256bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02
SHA5126e9b5e74aa8e569a2d30ae15f00131d37bdfc97ebf5dc78fca59e83f9188381f0b122fe462d7808bbcb7c2796b83a5bbb4691fcf2d46692d50a5782f452888e3
-
\Users\Admin\AppData\Roaming\TCPview\Tcpview.exeFilesize
194KB
MD53ec662d3e6a70da2a026951a987e4425
SHA137fa066e35cdbeae7fb2ef13529097b971773725
SHA256bc4dc46d7a7cd8693d04d5d78c91f584d03186bcd5246c5cd0dd546a13011d02
SHA5126e9b5e74aa8e569a2d30ae15f00131d37bdfc97ebf5dc78fca59e83f9188381f0b122fe462d7808bbcb7c2796b83a5bbb4691fcf2d46692d50a5782f452888e3
-
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1612-55-0x0000000000400000-0x0000000000834000-memory.dmpFilesize
4.2MB
-
memory/1612-56-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1612-57-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/1612-58-0x0000000000400000-0x0000000000834000-memory.dmpFilesize
4.2MB
-
memory/1612-63-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1860-61-0x0000000000000000-mapping.dmp
-
memory/1860-66-0x0000000000400000-0x0000000000834000-memory.dmpFilesize
4.2MB
-
memory/1860-67-0x0000000000250000-0x0000000000259000-memory.dmpFilesize
36KB