Analysis
-
max time kernel
145s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 21:04
Static task
static1
Behavioral task
behavioral1
Sample
af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe
Resource
win7-20220812-en
General
-
Target
af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe
-
Size
194KB
-
MD5
648b9256454643e44fce9401ce3042bf
-
SHA1
6479cbdea1a401e579d32cff10aeeef50db24a69
-
SHA256
af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043
-
SHA512
9db5119333b1916584b4e1f98dd4528e6a9a889127ff1f726566ab4411b239214002caf1e75eedde832abd7296e7c47ba1c71c708e6251fa1c98c02878c0912c
-
SSDEEP
6144:/9Xuji6hAheEsKL0PUmXruVSGGAVDFu3FZu:5reEpgGdVDIg
Malware Config
Signatures
-
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1628-61-0x0000000000400000-0x000000000041A000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
Tcpview.exepid process 980 Tcpview.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Tcpview.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{J1884FC2-E27H-5J10-BU60-8NS563BRYOR7} Tcpview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{J1884FC2-E27H-5J10-BU60-8NS563BRYOR7}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\TCPview\\Tcpview.exe\"" Tcpview.exe -
Processes:
resource yara_rule behavioral1/memory/1628-56-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1628-61-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/980-64-0x0000000000230000-0x0000000000239000-memory.dmp upx behavioral1/memory/980-65-0x0000000000400000-0x0000000000834000-memory.dmp upx behavioral1/memory/980-67-0x0000000000400000-0x0000000000834000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exepid process 1628 af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe 1628 af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Tcpview.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Tcpview.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\TCPview\\Tcpview.exe" Tcpview.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of UnmapMainImage 2 IoCs
Processes:
af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exeTcpview.exepid process 1628 af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe 980 Tcpview.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exedescription pid process target process PID 1628 wrote to memory of 980 1628 af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe Tcpview.exe PID 1628 wrote to memory of 980 1628 af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe Tcpview.exe PID 1628 wrote to memory of 980 1628 af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe Tcpview.exe PID 1628 wrote to memory of 980 1628 af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe Tcpview.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe"C:\Users\Admin\AppData\Local\Temp\af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TCPview\Tcpview.exe"C:\Users\Admin\AppData\Roaming\TCPview\Tcpview.exe"2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\TCPview\Tcpview.exeFilesize
194KB
MD5648b9256454643e44fce9401ce3042bf
SHA16479cbdea1a401e579d32cff10aeeef50db24a69
SHA256af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043
SHA5129db5119333b1916584b4e1f98dd4528e6a9a889127ff1f726566ab4411b239214002caf1e75eedde832abd7296e7c47ba1c71c708e6251fa1c98c02878c0912c
-
\Users\Admin\AppData\Roaming\TCPview\Tcpview.exeFilesize
194KB
MD5648b9256454643e44fce9401ce3042bf
SHA16479cbdea1a401e579d32cff10aeeef50db24a69
SHA256af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043
SHA5129db5119333b1916584b4e1f98dd4528e6a9a889127ff1f726566ab4411b239214002caf1e75eedde832abd7296e7c47ba1c71c708e6251fa1c98c02878c0912c
-
\Users\Admin\AppData\Roaming\TCPview\Tcpview.exeFilesize
194KB
MD5648b9256454643e44fce9401ce3042bf
SHA16479cbdea1a401e579d32cff10aeeef50db24a69
SHA256af3519c9db9356b3878a88db881866347f5313f66bc19fb16c1b792fd5a37043
SHA5129db5119333b1916584b4e1f98dd4528e6a9a889127ff1f726566ab4411b239214002caf1e75eedde832abd7296e7c47ba1c71c708e6251fa1c98c02878c0912c
-
memory/980-59-0x0000000000000000-mapping.dmp
-
memory/980-64-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/980-65-0x0000000000400000-0x0000000000834000-memory.dmpFilesize
4.2MB
-
memory/980-66-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/980-67-0x0000000000400000-0x0000000000834000-memory.dmpFilesize
4.2MB
-
memory/1628-54-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/1628-55-0x0000000000400000-0x0000000000834000-memory.dmpFilesize
4.2MB
-
memory/1628-56-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1628-61-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB