Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
16-03-2023 01:22
Behavioral task
behavioral1
Sample
7b0c5b6d2b384472a66a91446e3871a6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7b0c5b6d2b384472a66a91446e3871a6.exe
Resource
win10v2004-20230220-en
General
-
Target
7b0c5b6d2b384472a66a91446e3871a6.exe
-
Size
111KB
-
MD5
7b0c5b6d2b384472a66a91446e3871a6
-
SHA1
43f7d3727ff16afed19acd8a152c13b72b789d5f
-
SHA256
48d5f8ef5449387f721907a96a8eab0f7827f393db4c96d351bab43de7944d95
-
SHA512
214b1ec30417fd5c009f7cace9855d2bff2417099d6b863fbc014bc57a0e041b100a7585dd719af0d3398474b860f05d75d7b8fc3f979b2a8eada2d1b362e501
-
SSDEEP
768:iH059SCyqm4AxvqFTTT5jTTTT+lYeAcoMNii6LKtMwZ5JkQ0sKoIQr0/FLyTsMa7:807SCxCQTTT5jTTTT+rzVb00fLZDQ
Malware Config
Extracted
purecrypter
https://firebasestorage.googleapis.com/v0/b/hjop-9ee35.appspot.com/o/Xuwbqh.dat?alt=media&token=f8835a49-5488-429f-8453-0ec2ff1d135e
Extracted
netwire
netwire2021.duckdns.org:7929
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
qFlJFfII
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
true
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7b0c5b6d2b384472a66a91446e3871a6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\rttyr.exe\"," 7b0c5b6d2b384472a66a91446e3871a6.exe -
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1972-75-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1972-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1972-77-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1972-72-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1972-79-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1972-80-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
7b0c5b6d2b384472a66a91446e3871a6.exedescription pid process target process PID 1148 set thread context of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1484 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7b0c5b6d2b384472a66a91446e3871a6.exepowershell.exedescription pid process Token: SeDebugPrivilege 1148 7b0c5b6d2b384472a66a91446e3871a6.exe Token: SeDebugPrivilege 1484 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 1356 DllHost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
7b0c5b6d2b384472a66a91446e3871a6.exedescription pid process target process PID 1148 wrote to memory of 1484 1148 7b0c5b6d2b384472a66a91446e3871a6.exe powershell.exe PID 1148 wrote to memory of 1484 1148 7b0c5b6d2b384472a66a91446e3871a6.exe powershell.exe PID 1148 wrote to memory of 1484 1148 7b0c5b6d2b384472a66a91446e3871a6.exe powershell.exe PID 1148 wrote to memory of 1484 1148 7b0c5b6d2b384472a66a91446e3871a6.exe powershell.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe PID 1148 wrote to memory of 1972 1148 7b0c5b6d2b384472a66a91446e3871a6.exe 7b0c5b6d2b384472a66a91446e3871a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b0c5b6d2b384472a66a91446e3871a6.exe"C:\Users\Admin\AppData\Local\Temp\7b0c5b6d2b384472a66a91446e3871a6.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7b0c5b6d2b384472a66a91446e3871a6.exeC:\Users\Admin\AppData\Local\Temp\7b0c5b6d2b384472a66a91446e3871a6.exe2⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Vshuffmzutgmofdlthunderbird-square.icoFilesize
54KB
MD564e0d3e737a61bd7f0abb6128dc005a7
SHA10d874db8fff6b065a7235c739e6fa37a0d3ddb6d
SHA25698f2a3481d416099a2bb02bb26a967fb6ed77dbedf490a8f9d8bcba500e79b7d
SHA512ef898917e72aa768f0a63672a7459da57a462ab3822400adbf722987f08d8ec89d7a8ef7368cd02badac8095e19a65f70b931b2e2c41e92686fb37393826d408
-
memory/1148-55-0x0000000004DB0000-0x0000000004DF0000-memory.dmpFilesize
256KB
-
memory/1148-56-0x0000000007CF0000-0x0000000007DAA000-memory.dmpFilesize
744KB
-
memory/1148-57-0x0000000000930000-0x0000000000954000-memory.dmpFilesize
144KB
-
memory/1148-61-0x0000000004DB0000-0x0000000004DF0000-memory.dmpFilesize
256KB
-
memory/1148-64-0x0000000004690000-0x0000000004692000-memory.dmpFilesize
8KB
-
memory/1148-54-0x0000000000960000-0x0000000000980000-memory.dmpFilesize
128KB
-
memory/1356-81-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1356-65-0x00000000000F0000-0x00000000000F2000-memory.dmpFilesize
8KB
-
memory/1356-66-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1484-60-0x00000000023B0000-0x00000000023F0000-memory.dmpFilesize
256KB
-
memory/1972-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1972-75-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1972-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1972-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1972-77-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1972-72-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1972-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1972-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1972-79-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1972-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1972-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB