Resubmissions
11-01-2023 16:05
230111-tjr18shc9s 1011-01-2023 16:03
230111-thmp5ahc8x 1011-01-2023 10:15
230111-maal9sbg63 10Analysis
-
max time kernel
84s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-01-2023 16:05
Static task
static1
Behavioral task
behavioral1
Sample
PO 9047579 FDX PREMIUM 96 NTZ.exe
Resource
win7-20220812-en
General
-
Target
PO 9047579 FDX PREMIUM 96 NTZ.exe
-
Size
621KB
-
MD5
ccc5553d844306dac7d4e112d27b6bf8
-
SHA1
4699f3485ba9da714ea346c0aa1db2bb35947dda
-
SHA256
5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2
-
SHA512
bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c
-
SSDEEP
12288:lAfWCREY+hUP5MMBn1CyvVwviXN4Nq0ymm82Ss0a15wKchkv3Am+8ubkw:6+07RBMMt1L9hwq0yb82SjywKcSvF+bf
Malware Config
Extracted
netwire
212.193.30.230:6063
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
TestLink.lnk
-
lock_executable
false
-
offline_keylogger
false
-
password
Password123@
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1680-69-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1680-72-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1680-71-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1680-75-0x000000000041AD7B-mapping.dmp netwire behavioral1/memory/1680-74-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1680-78-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1680-83-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1812-105-0x000000000041AD7B-mapping.dmp netwire behavioral1/memory/1812-109-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1812-112-0x0000000000400000-0x000000000044F000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 820 Host.exe 1812 Host.exe -
Drops startup file 1 IoCs
Processes:
Host.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TestLink.lnk Host.exe -
Loads dropped DLL 3 IoCs
Processes:
PO 9047579 FDX PREMIUM 96 NTZ.exeHost.exepid process 1680 PO 9047579 FDX PREMIUM 96 NTZ.exe 1680 PO 9047579 FDX PREMIUM 96 NTZ.exe 1812 Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vÀÙá=ëÏþ½Pe… = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
PO 9047579 FDX PREMIUM 96 NTZ.exeHost.exedescription pid process target process PID 2036 set thread context of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 820 set thread context of 1812 820 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1804 schtasks.exe 1720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
PO 9047579 FDX PREMIUM 96 NTZ.exepowershell.exeHost.exepowershell.exepid process 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe 1868 powershell.exe 820 Host.exe 664 powershell.exe 820 Host.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO 9047579 FDX PREMIUM 96 NTZ.exepowershell.exeHost.exepowershell.exedescription pid process Token: SeDebugPrivilege 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe Token: SeDebugPrivilege 1868 powershell.exe Token: SeDebugPrivilege 820 Host.exe Token: SeDebugPrivilege 664 powershell.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
PO 9047579 FDX PREMIUM 96 NTZ.exePO 9047579 FDX PREMIUM 96 NTZ.exeHost.exedescription pid process target process PID 2036 wrote to memory of 1868 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe powershell.exe PID 2036 wrote to memory of 1868 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe powershell.exe PID 2036 wrote to memory of 1868 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe powershell.exe PID 2036 wrote to memory of 1868 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe powershell.exe PID 2036 wrote to memory of 1804 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe schtasks.exe PID 2036 wrote to memory of 1804 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe schtasks.exe PID 2036 wrote to memory of 1804 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe schtasks.exe PID 2036 wrote to memory of 1804 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe schtasks.exe PID 2036 wrote to memory of 1320 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1320 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1320 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1320 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 2036 wrote to memory of 1680 2036 PO 9047579 FDX PREMIUM 96 NTZ.exe PO 9047579 FDX PREMIUM 96 NTZ.exe PID 1680 wrote to memory of 820 1680 PO 9047579 FDX PREMIUM 96 NTZ.exe Host.exe PID 1680 wrote to memory of 820 1680 PO 9047579 FDX PREMIUM 96 NTZ.exe Host.exe PID 1680 wrote to memory of 820 1680 PO 9047579 FDX PREMIUM 96 NTZ.exe Host.exe PID 1680 wrote to memory of 820 1680 PO 9047579 FDX PREMIUM 96 NTZ.exe Host.exe PID 820 wrote to memory of 664 820 Host.exe powershell.exe PID 820 wrote to memory of 664 820 Host.exe powershell.exe PID 820 wrote to memory of 664 820 Host.exe powershell.exe PID 820 wrote to memory of 664 820 Host.exe powershell.exe PID 820 wrote to memory of 1720 820 Host.exe schtasks.exe PID 820 wrote to memory of 1720 820 Host.exe schtasks.exe PID 820 wrote to memory of 1720 820 Host.exe schtasks.exe PID 820 wrote to memory of 1720 820 Host.exe schtasks.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe PID 820 wrote to memory of 1812 820 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe"C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aTGTGTYybfHCv.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aTGTGTYybfHCv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe"C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe"C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aTGTGTYybfHCv.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aTGTGTYybfHCv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4645.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4645.tmpFilesize
1KB
MD5468f0c8b9f88c4307568493b494afef6
SHA13e9240e69aa0e5d0041524c630890f93377d8d58
SHA2563125f0828e2a9c8ad687d1ff14320b9aedf1f2eaf774ad645641f46954f58a92
SHA5120e91acf39673845bf8e9ff57511fb55c9ff2f78f23d7458bf1a5415b586516e0745a484bf7a88575962317e37508b00ba1dae75a33d1387874185849eeb63fc3
-
C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmpFilesize
1KB
MD5468f0c8b9f88c4307568493b494afef6
SHA13e9240e69aa0e5d0041524c630890f93377d8d58
SHA2563125f0828e2a9c8ad687d1ff14320b9aedf1f2eaf774ad645641f46954f58a92
SHA5120e91acf39673845bf8e9ff57511fb55c9ff2f78f23d7458bf1a5415b586516e0745a484bf7a88575962317e37508b00ba1dae75a33d1387874185849eeb63fc3
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
621KB
MD5ccc5553d844306dac7d4e112d27b6bf8
SHA14699f3485ba9da714ea346c0aa1db2bb35947dda
SHA2565a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2
SHA512bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
621KB
MD5ccc5553d844306dac7d4e112d27b6bf8
SHA14699f3485ba9da714ea346c0aa1db2bb35947dda
SHA2565a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2
SHA512bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
621KB
MD5ccc5553d844306dac7d4e112d27b6bf8
SHA14699f3485ba9da714ea346c0aa1db2bb35947dda
SHA2565a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2
SHA512bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5ec82b538c54f2c7cbf3fab2b8178cd9f
SHA14ff663d9d8d8e6f4d83b1afa6b3aaeca0ae154dd
SHA2564136356e420937ae7f7b7330caaa10860ac9a417f9ae3b17336e0522c9a377b7
SHA512abc821cc7fe003ab294b1af94bd54591db5eeecdfdda946639103fcbcaa48f46d86a29070e45b0073e0b4409e80adbec393d77579bb18fbcf240bad2f6634d3c
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
621KB
MD5ccc5553d844306dac7d4e112d27b6bf8
SHA14699f3485ba9da714ea346c0aa1db2bb35947dda
SHA2565a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2
SHA512bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
621KB
MD5ccc5553d844306dac7d4e112d27b6bf8
SHA14699f3485ba9da714ea346c0aa1db2bb35947dda
SHA2565a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2
SHA512bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
621KB
MD5ccc5553d844306dac7d4e112d27b6bf8
SHA14699f3485ba9da714ea346c0aa1db2bb35947dda
SHA2565a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2
SHA512bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c
-
memory/664-89-0x0000000000000000-mapping.dmp
-
memory/664-111-0x0000000073330000-0x00000000738DB000-memory.dmpFilesize
5.7MB
-
memory/820-81-0x0000000000000000-mapping.dmp
-
memory/820-85-0x0000000000BC0000-0x0000000000C62000-memory.dmpFilesize
648KB
-
memory/1680-83-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1680-65-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1680-75-0x000000000041AD7B-mapping.dmp
-
memory/1680-74-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1680-78-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1680-64-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1680-71-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1680-72-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1680-67-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1680-69-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1720-90-0x0000000000000000-mapping.dmp
-
memory/1804-60-0x0000000000000000-mapping.dmp
-
memory/1812-105-0x000000000041AD7B-mapping.dmp
-
memory/1812-112-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1812-109-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1868-59-0x0000000000000000-mapping.dmp
-
memory/1868-87-0x000000006E9B0000-0x000000006EF5B000-memory.dmpFilesize
5.7MB
-
memory/1868-88-0x000000006E9B0000-0x000000006EF5B000-memory.dmpFilesize
5.7MB
-
memory/2036-63-0x0000000005E70000-0x0000000005EBC000-memory.dmpFilesize
304KB
-
memory/2036-56-0x0000000000240000-0x0000000000256000-memory.dmpFilesize
88KB
-
memory/2036-57-0x00000000003A0000-0x00000000003AA000-memory.dmpFilesize
40KB
-
memory/2036-55-0x00000000762D1000-0x00000000762D3000-memory.dmpFilesize
8KB
-
memory/2036-58-0x00000000052A0000-0x0000000005326000-memory.dmpFilesize
536KB
-
memory/2036-54-0x0000000000810000-0x00000000008B2000-memory.dmpFilesize
648KB