Analysis
-
max time kernel
60s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
20-01-2023 09:38
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe
Resource
win7-20221111-en
General
-
Target
SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe
-
Size
890KB
-
MD5
04b48402ad5185ef1565a3fb9bf1aefe
-
SHA1
06ad32d4b8b1ac735077dc9e7768eb649df4cb97
-
SHA256
26f3ec45fc6fe6c84d815288a447499ef507c6a8b0f3abc473bfbc69eaf20c49
-
SHA512
529e8d73a20a6af6d8836c2e2c44a286c013bf333f51fbd6b08598cc02d9bf5c95eb2b9aa8fa16310ff7650a5a5ba2eaf03ed08ceed2d90b5287a0a9dad56fb5
-
SSDEEP
12288:kQdIxEnJFilzPypo07HoRyvviQ4kAVyEe8SwOylum:pexEjOPy+RP5lguO9m
Malware Config
Extracted
netwire
212.193.30.230:3361
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Telkomsa@1991
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1828-69-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/1828-72-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/1828-70-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/1828-75-0x00000000004026D0-mapping.dmp netwire behavioral1/memory/1828-74-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/1828-78-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/1828-80-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/1828-82-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exedescription pid process target process PID 2008 set thread context of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exepowershell.exepid process 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe 932 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exepowershell.exedescription pid process Token: SeDebugPrivilege 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe Token: SeDebugPrivilege 932 powershell.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exedescription pid process target process PID 2008 wrote to memory of 932 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe powershell.exe PID 2008 wrote to memory of 932 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe powershell.exe PID 2008 wrote to memory of 932 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe powershell.exe PID 2008 wrote to memory of 932 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe powershell.exe PID 2008 wrote to memory of 664 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe schtasks.exe PID 2008 wrote to memory of 664 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe schtasks.exe PID 2008 wrote to memory of 664 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe schtasks.exe PID 2008 wrote to memory of 664 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe schtasks.exe PID 2008 wrote to memory of 1264 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1264 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1264 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1264 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe PID 2008 wrote to memory of 1828 2008 SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lSDctUklJYlmEU.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:932 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lSDctUklJYlmEU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA610.tmp"2⤵
- Creates scheduled task(s)
PID:664 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"2⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"2⤵PID:1828
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA610.tmpFilesize
1KB
MD5caea0f05039588b8e9a346aa8243aa48
SHA19bd938a16a6f931bf6f7836ad5654712f27c9e7a
SHA25645b829f419f600d8ad489d8be358c87655cbe165844add0c29ab73b19b9ecea8
SHA512e12c00de996cbc386c15a61e5282d67c8d0d96c418fa4695e33bf6d8ffa6f654850fd45424275ebddda6d521ec10116dfa6ac65600073782840dfc0862799664
-
memory/664-60-0x0000000000000000-mapping.dmp
-
memory/932-59-0x0000000000000000-mapping.dmp
-
memory/932-81-0x000000006E550000-0x000000006EAFB000-memory.dmpFilesize
5.7MB
-
memory/932-79-0x000000006E550000-0x000000006EAFB000-memory.dmpFilesize
5.7MB
-
memory/1828-67-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-74-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-82-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-80-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-64-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-78-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-69-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-72-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-70-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-65-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1828-75-0x00000000004026D0-mapping.dmp
-
memory/2008-54-0x0000000000DB0000-0x0000000000E94000-memory.dmpFilesize
912KB
-
memory/2008-58-0x0000000004F90000-0x0000000004FF2000-memory.dmpFilesize
392KB
-
memory/2008-56-0x0000000000510000-0x0000000000526000-memory.dmpFilesize
88KB
-
memory/2008-63-0x0000000004C40000-0x0000000004C68000-memory.dmpFilesize
160KB
-
memory/2008-55-0x00000000760C1000-0x00000000760C3000-memory.dmpFilesize
8KB
-
memory/2008-57-0x00000000009F0000-0x00000000009FA000-memory.dmpFilesize
40KB