Analysis
-
max time kernel
199s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 18:20
Static task
static1
Behavioral task
behavioral1
Sample
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe
Resource
win7-20220812-en
General
-
Target
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe
-
Size
679KB
-
MD5
6849594bb5bf5ef5c7dad7c530d6e9dc
-
SHA1
e067a1e42e718d561cd5a1d70b3cf7348e603947
-
SHA256
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e
-
SHA512
9ed5ae5e3123c37ccb75631c63b056e5531589aee823052877c05d972e8962644c55651a5202d669eef47932413f3ae939b7f3c020a2d325644dc38ee4ded46d
-
SSDEEP
12288:mK2mhAMJ/cPl5SIFhjHfZqp38h7UZYE82Y5UKUL4n4y3Xp3SbSlNHNU:H2O/Gl5rdfR7g6zwm4m53Sb2rU
Malware Config
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1888-138-0x0000000000000000-mapping.dmp netwire behavioral2/memory/1888-139-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/1888-141-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/1888-142-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
lidtjnltu.exepid process 4924 lidtjnltu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
lidtjnltu.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce lidtjnltu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\7XOG67~1 = "C:\\Users\\Admin\\7XOG67~1\\ymkus.vbs" lidtjnltu.exe -
Processes:
lidtjnltu.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lidtjnltu.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lidtjnltu.exedescription pid process target process PID 4924 set thread context of 1888 4924 lidtjnltu.exe RegSvcs.exe -
Drops file in Windows directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier RegSvcs.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\.Identifier RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
lidtjnltu.exepid process 4924 lidtjnltu.exe 4924 lidtjnltu.exe 4924 lidtjnltu.exe 4924 lidtjnltu.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exelidtjnltu.exedescription pid process target process PID 1700 wrote to memory of 4924 1700 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 1700 wrote to memory of 4924 1700 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 1700 wrote to memory of 4924 1700 37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe lidtjnltu.exe PID 4924 wrote to memory of 1888 4924 lidtjnltu.exe RegSvcs.exe PID 4924 wrote to memory of 1888 4924 lidtjnltu.exe RegSvcs.exe PID 4924 wrote to memory of 1888 4924 lidtjnltu.exe RegSvcs.exe PID 4924 wrote to memory of 1888 4924 lidtjnltu.exe RegSvcs.exe PID 4924 wrote to memory of 1888 4924 lidtjnltu.exe RegSvcs.exe PID 4924 wrote to memory of 1888 4924 lidtjnltu.exe RegSvcs.exe PID 4924 wrote to memory of 1888 4924 lidtjnltu.exe RegSvcs.exe PID 4924 wrote to memory of 1888 4924 lidtjnltu.exe RegSvcs.exe PID 4924 wrote to memory of 1888 4924 lidtjnltu.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe"C:\Users\Admin\AppData\Local\Temp\37f300481c85b382f84cbde9e53b84997659ab49a2d11b089ac3ecf18933db0e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\7xog675ium\lidtjnltu.exe"C:\Users\Admin\7xog675ium\lidtjnltu.exe" twbtpbuwce2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\7XOG67~1\VQHYER~1.KMAFilesize
81KB
MD5197a0ddebb03ba23a206474d3c4f2d3b
SHA1d4372c5184627be231613f062b63c34a9aa534ac
SHA256b012cd0baeb36d4b93fb8e4305243fbeda173ccb608e0dc6a9930662e6bdc825
SHA5123843439c2964837628947f3a3135de86bc52fd341dfe4f5490457177a7a8328cfcf7e852739b1740059c1c7e46540d2abeb9ae1ce94b2c8214674bd028a58fda
-
C:\Users\Admin\7XOG67~1\qmzpnx.GIHFilesize
87B
MD5dc51be2bbbcd55cf7fd8c1ae7bafd2e9
SHA15bb122092c88433bf62bafa6e9a9b1ce7eb75643
SHA2569658def8061ad1f0e2588e8e14c61c72b0daa42c5b8690628254a770d89d8330
SHA512659ed9d8447292d9b253a50b40fadf08dd31eb55f2a487d22a61e7ee63e2b8d5e8507eb342d0929996d89294f0b9527776319714fa0364fddce74e5ed72c01b7
-
C:\Users\Admin\7xog675ium\lidtjnltu.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\7xog675ium\lidtjnltu.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\7xog675ium\twbtpbuwceFilesize
218.9MB
MD5b7fdf2bb72e48d9cf3542eceaac529bd
SHA140f6a3cbe519eef51d3f412b15fba63ad3240f93
SHA256f52effa7c36732c2daa21c6c90d9f4ab3b1086a4c33662e8da6b28ed284eda9c
SHA51285f1547138ee5c5cbf6979e28889801a2dcdc25969eabd47e91535abdba16d835f9138205a5a021d05595cda5d965b9ba49fed6d791cfbc72bcd1ee735c980db
-
memory/1888-138-0x0000000000000000-mapping.dmp
-
memory/1888-139-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1888-141-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1888-142-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4924-132-0x0000000000000000-mapping.dmp