Analysis
-
max time kernel
106s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 11:21
Static task
static1
Behavioral task
behavioral1
Sample
aa63661edf36159a1d74f649cfec2c7d.exe
Resource
win7-20221111-en
General
-
Target
aa63661edf36159a1d74f649cfec2c7d.exe
-
Size
902KB
-
MD5
aa63661edf36159a1d74f649cfec2c7d
-
SHA1
cc15fa8efcfb5ecdddc86b081788cfac888ce4fb
-
SHA256
c8a9fa4307b87bcbb0091ba8541431367cbad068a092a6a8e968e1d26aab3172
-
SHA512
f47d647543a928d7619211269876aa4bc0cf150078a8a9dd0d28e4e30aa648d026c3538efa71b2f1b99441371953a9729c4f9dcd8b1e1f6c5bc2d8dd5551f589
-
SSDEEP
24576:JA37TnTIW2gpMxdDOZXtFccXMeaJXCrxN5IC54TWM:OPcW2txdDOZXf3Uytgi
Malware Config
Extracted
netwire
156.96.113.208:7201
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
super%
-
lock_executable
false
-
mutex
vYtHuXLf
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4352-143-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/4352-144-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/4352-145-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/4352-147-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/4352-161-0x0000000000400000-0x000000000044F000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
aa63661edf36159a1d74f649cfec2c7d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation aa63661edf36159a1d74f649cfec2c7d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aa63661edf36159a1d74f649cfec2c7d.exedescription pid process target process PID 372 set thread context of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
aa63661edf36159a1d74f649cfec2c7d.exepowershell.exepid process 372 aa63661edf36159a1d74f649cfec2c7d.exe 372 aa63661edf36159a1d74f649cfec2c7d.exe 3940 powershell.exe 3940 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aa63661edf36159a1d74f649cfec2c7d.exepowershell.exedescription pid process Token: SeDebugPrivilege 372 aa63661edf36159a1d74f649cfec2c7d.exe Token: SeDebugPrivilege 3940 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
aa63661edf36159a1d74f649cfec2c7d.exedescription pid process target process PID 372 wrote to memory of 3940 372 aa63661edf36159a1d74f649cfec2c7d.exe powershell.exe PID 372 wrote to memory of 3940 372 aa63661edf36159a1d74f649cfec2c7d.exe powershell.exe PID 372 wrote to memory of 3940 372 aa63661edf36159a1d74f649cfec2c7d.exe powershell.exe PID 372 wrote to memory of 4908 372 aa63661edf36159a1d74f649cfec2c7d.exe schtasks.exe PID 372 wrote to memory of 4908 372 aa63661edf36159a1d74f649cfec2c7d.exe schtasks.exe PID 372 wrote to memory of 4908 372 aa63661edf36159a1d74f649cfec2c7d.exe schtasks.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe PID 372 wrote to memory of 4352 372 aa63661edf36159a1d74f649cfec2c7d.exe aa63661edf36159a1d74f649cfec2c7d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa63661edf36159a1d74f649cfec2c7d.exe"C:\Users\Admin\AppData\Local\Temp\aa63661edf36159a1d74f649cfec2c7d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KHzfPiW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KHzfPiW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1FAD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\aa63661edf36159a1d74f649cfec2c7d.exe"C:\Users\Admin\AppData\Local\Temp\aa63661edf36159a1d74f649cfec2c7d.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1FAD.tmpFilesize
1KB
MD5b640edb51fc25bdb1b95e1557cdf0d86
SHA189a7aa8c7fc916874b2737a22851ec516488f147
SHA2560897d94fb8e787f7795e9fbb21b2912e4804a9c100162f9e22c794e52f267bcb
SHA512f816ff4ae6ff1cc4c3dd3f362c876d98d83bad3c27754962a44d533886009ed94ab3e6074d9ae81ea6fb2e5a7d22ed365da323ccb2ae69591405d8479bfbf5a3
-
memory/372-133-0x0000000005320000-0x00000000058C4000-memory.dmpFilesize
5.6MB
-
memory/372-134-0x0000000004D70000-0x0000000004E02000-memory.dmpFilesize
584KB
-
memory/372-135-0x0000000004F20000-0x0000000004F2A000-memory.dmpFilesize
40KB
-
memory/372-136-0x0000000008720000-0x00000000087BC000-memory.dmpFilesize
624KB
-
memory/372-132-0x00000000002F0000-0x00000000003D6000-memory.dmpFilesize
920KB
-
memory/3940-146-0x0000000005260000-0x0000000005282000-memory.dmpFilesize
136KB
-
memory/3940-154-0x0000000007B80000-0x00000000081FA000-memory.dmpFilesize
6.5MB
-
memory/3940-160-0x0000000007860000-0x0000000007868000-memory.dmpFilesize
32KB
-
memory/3940-159-0x0000000007880000-0x000000000789A000-memory.dmpFilesize
104KB
-
memory/3940-142-0x0000000005360000-0x0000000005988000-memory.dmpFilesize
6.2MB
-
memory/3940-158-0x0000000007770000-0x000000000777E000-memory.dmpFilesize
56KB
-
memory/3940-157-0x00000000077C0000-0x0000000007856000-memory.dmpFilesize
600KB
-
memory/3940-156-0x00000000075B0000-0x00000000075BA000-memory.dmpFilesize
40KB
-
memory/3940-137-0x0000000000000000-mapping.dmp
-
memory/3940-155-0x0000000007540000-0x000000000755A000-memory.dmpFilesize
104KB
-
memory/3940-148-0x0000000005B00000-0x0000000005B66000-memory.dmpFilesize
408KB
-
memory/3940-149-0x0000000005BE0000-0x0000000005C46000-memory.dmpFilesize
408KB
-
memory/3940-150-0x0000000006230000-0x000000000624E000-memory.dmpFilesize
120KB
-
memory/3940-151-0x00000000067F0000-0x0000000006822000-memory.dmpFilesize
200KB
-
memory/3940-152-0x00000000703E0000-0x000000007042C000-memory.dmpFilesize
304KB
-
memory/3940-153-0x00000000067D0000-0x00000000067EE000-memory.dmpFilesize
120KB
-
memory/3940-139-0x0000000004C80000-0x0000000004CB6000-memory.dmpFilesize
216KB
-
memory/4352-147-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4352-145-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4352-144-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4352-143-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4352-141-0x0000000000000000-mapping.dmp
-
memory/4352-161-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4908-138-0x0000000000000000-mapping.dmp