Analysis
-
max time kernel
65s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 11:21
Static task
static1
Behavioral task
behavioral1
Sample
aa63661edf36159a1d74f649cfec2c7d.exe
Resource
win7-20221111-en
General
-
Target
aa63661edf36159a1d74f649cfec2c7d.exe
-
Size
902KB
-
MD5
aa63661edf36159a1d74f649cfec2c7d
-
SHA1
cc15fa8efcfb5ecdddc86b081788cfac888ce4fb
-
SHA256
c8a9fa4307b87bcbb0091ba8541431367cbad068a092a6a8e968e1d26aab3172
-
SHA512
f47d647543a928d7619211269876aa4bc0cf150078a8a9dd0d28e4e30aa648d026c3538efa71b2f1b99441371953a9729c4f9dcd8b1e1f6c5bc2d8dd5551f589
-
SSDEEP
24576:JA37TnTIW2gpMxdDOZXtFccXMeaJXCrxN5IC54TWM:OPcW2txdDOZXf3Uytgi
Malware Config
Extracted
netwire
156.96.113.208:7201
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
super%
-
lock_executable
false
-
mutex
vYtHuXLf
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1460-69-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1460-71-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1460-72-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1460-75-0x000000000041AD7B-mapping.dmp netwire behavioral1/memory/1460-74-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1460-78-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1460-80-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral1/memory/1460-82-0x0000000000400000-0x000000000044F000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aa63661edf36159a1d74f649cfec2c7d.exedescription pid process target process PID 1504 set thread context of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
aa63661edf36159a1d74f649cfec2c7d.exepowershell.exepid process 1504 aa63661edf36159a1d74f649cfec2c7d.exe 1504 aa63661edf36159a1d74f649cfec2c7d.exe 1716 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aa63661edf36159a1d74f649cfec2c7d.exepowershell.exedescription pid process Token: SeDebugPrivilege 1504 aa63661edf36159a1d74f649cfec2c7d.exe Token: SeDebugPrivilege 1716 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
aa63661edf36159a1d74f649cfec2c7d.exedescription pid process target process PID 1504 wrote to memory of 1716 1504 aa63661edf36159a1d74f649cfec2c7d.exe powershell.exe PID 1504 wrote to memory of 1716 1504 aa63661edf36159a1d74f649cfec2c7d.exe powershell.exe PID 1504 wrote to memory of 1716 1504 aa63661edf36159a1d74f649cfec2c7d.exe powershell.exe PID 1504 wrote to memory of 1716 1504 aa63661edf36159a1d74f649cfec2c7d.exe powershell.exe PID 1504 wrote to memory of 944 1504 aa63661edf36159a1d74f649cfec2c7d.exe schtasks.exe PID 1504 wrote to memory of 944 1504 aa63661edf36159a1d74f649cfec2c7d.exe schtasks.exe PID 1504 wrote to memory of 944 1504 aa63661edf36159a1d74f649cfec2c7d.exe schtasks.exe PID 1504 wrote to memory of 944 1504 aa63661edf36159a1d74f649cfec2c7d.exe schtasks.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 1504 wrote to memory of 1460 1504 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa63661edf36159a1d74f649cfec2c7d.exe"C:\Users\Admin\AppData\Local\Temp\aa63661edf36159a1d74f649cfec2c7d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KHzfPiW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KHzfPiW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC218.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\aa63661edf36159a1d74f649cfec2c7d.exe"C:\Users\Admin\AppData\Local\Temp\aa63661edf36159a1d74f649cfec2c7d.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC218.tmpFilesize
1KB
MD5ab9f0947c4a98aeb543833ff1b561744
SHA17bca28a4e38aaf3d4535e84b1a87d802aaca79ec
SHA2564bbe08b588f9669b912d308de9ed0d9c3be561f83b528961dace43b6d4d25a5b
SHA5123faf12a4c24e183ef532d3207350de4adf9210006384e5e2dab8af761647f4b8ab51042c15cdd52a7f682e6dc789a3277b5c7eefc7013bbe79f7349aa7efc1c8
-
memory/944-60-0x0000000000000000-mapping.dmp
-
memory/1460-75-0x000000000041AD7B-mapping.dmp
-
memory/1460-71-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1460-82-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1460-80-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1460-78-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1460-74-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1460-72-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1460-64-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1460-65-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1460-67-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1460-69-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1504-55-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1504-63-0x0000000004D10000-0x0000000004D5C000-memory.dmpFilesize
304KB
-
memory/1504-54-0x0000000000920000-0x0000000000A06000-memory.dmpFilesize
920KB
-
memory/1504-57-0x00000000004E0000-0x00000000004EC000-memory.dmpFilesize
48KB
-
memory/1504-56-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1504-58-0x0000000005FB0000-0x000000000605E000-memory.dmpFilesize
696KB
-
memory/1716-79-0x000000006DBA0000-0x000000006E14B000-memory.dmpFilesize
5.7MB
-
memory/1716-59-0x0000000000000000-mapping.dmp
-
memory/1716-81-0x000000006DBA0000-0x000000006E14B000-memory.dmpFilesize
5.7MB