Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 15:52
Static task
static1
Behavioral task
behavioral1
Sample
76218662ffd8397441fadb34d12de1cc.exe
Resource
win7-20221111-en
General
-
Target
76218662ffd8397441fadb34d12de1cc.exe
-
Size
719KB
-
MD5
76218662ffd8397441fadb34d12de1cc
-
SHA1
6432944d6cb7e5acc434d8d7a017c2ae6c21b426
-
SHA256
7a0c3008b65ed5033cc3663e9104ed7b39707c2a073ef3626549e0acd64f15f2
-
SHA512
3797d6d25f877f2cfcfa57b4a6ba1a3087f557314b684f78d8c72f53acdde71df7653c99603f3e683b8a2ad8d0a5c8615d9eaa165358d5bb19212d2007ad8d17
-
SSDEEP
12288:Frp6gxML2DQ8iFoFEyK0xlDxjIWD7+j3c1z3tTm9OrncN6lcQBb:FrfxMXSCp0r6WmjM1z39AAn
Malware Config
Extracted
netwire
212.193.30.230:3363
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@2
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1896-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1896-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1896-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1896-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1896-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1896-75-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1896-78-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1896-80-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
76218662ffd8397441fadb34d12de1cc.exedescription pid process target process PID 788 set thread context of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1660 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1660 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
76218662ffd8397441fadb34d12de1cc.exedescription pid process target process PID 788 wrote to memory of 1660 788 76218662ffd8397441fadb34d12de1cc.exe powershell.exe PID 788 wrote to memory of 1660 788 76218662ffd8397441fadb34d12de1cc.exe powershell.exe PID 788 wrote to memory of 1660 788 76218662ffd8397441fadb34d12de1cc.exe powershell.exe PID 788 wrote to memory of 1660 788 76218662ffd8397441fadb34d12de1cc.exe powershell.exe PID 788 wrote to memory of 1068 788 76218662ffd8397441fadb34d12de1cc.exe schtasks.exe PID 788 wrote to memory of 1068 788 76218662ffd8397441fadb34d12de1cc.exe schtasks.exe PID 788 wrote to memory of 1068 788 76218662ffd8397441fadb34d12de1cc.exe schtasks.exe PID 788 wrote to memory of 1068 788 76218662ffd8397441fadb34d12de1cc.exe schtasks.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe PID 788 wrote to memory of 1896 788 76218662ffd8397441fadb34d12de1cc.exe 76218662ffd8397441fadb34d12de1cc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76218662ffd8397441fadb34d12de1cc.exe"C:\Users\Admin\AppData\Local\Temp\76218662ffd8397441fadb34d12de1cc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ogOazdrNW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ogOazdrNW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9B95.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\76218662ffd8397441fadb34d12de1cc.exe"C:\Users\Admin\AppData\Local\Temp\76218662ffd8397441fadb34d12de1cc.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9B95.tmpFilesize
1KB
MD5c0d79192e17f35ba7d6b61a323c79b2f
SHA12b8829a686c1a00e250e4ac0ec29c61db6afc88f
SHA2565166cbc066219b14de4d6ceed3ab76c9a3c3b39a0c3aa191e27e79317a1a8254
SHA512776896472b7b56a6721bc3a952cfa2b44317602449fcbce568101161a8da666201f29da18402f155ba3eccea42c5410e87dc315abcfdafb6570ea7747370a6cc
-
memory/788-55-0x00000000763D1000-0x00000000763D3000-memory.dmpFilesize
8KB
-
memory/788-56-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/788-57-0x00000000009D0000-0x00000000009DA000-memory.dmpFilesize
40KB
-
memory/788-58-0x0000000005120000-0x0000000005188000-memory.dmpFilesize
416KB
-
memory/788-63-0x0000000004AB0000-0x0000000004AE0000-memory.dmpFilesize
192KB
-
memory/788-54-0x0000000001350000-0x000000000140A000-memory.dmpFilesize
744KB
-
memory/1068-60-0x0000000000000000-mapping.dmp
-
memory/1660-79-0x000000006ECF0000-0x000000006F29B000-memory.dmpFilesize
5.7MB
-
memory/1660-59-0x0000000000000000-mapping.dmp
-
memory/1660-81-0x000000006ECF0000-0x000000006F29B000-memory.dmpFilesize
5.7MB
-
memory/1896-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1896-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1896-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1896-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1896-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1896-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1896-75-0x000000000040242D-mapping.dmp
-
memory/1896-78-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1896-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1896-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1896-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB