Analysis
-
max time kernel
17s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 19:53
Static task
static1
2 signatures
General
-
Target
UNICEF COVID-19 APP.exe
-
Size
1.6MB
-
MD5
e33ca6e0ec223d2b3e958131424eff4a
-
SHA1
95d900e5915d99ad55fb24ed8c6d04a804035b45
-
SHA256
1b15ef17ccb1a99c3953f61de01ebceaeef2277b3b5939408050dc7c1010d1bb
-
SHA512
330731c2fda4b2af15d13bd7469d79d7ec14039da61fb763cfe030bf91f1244856a9c9e32a89e19a55363e82e5aba2cb3718599089d01314ca675a1dafabbd56
-
SSDEEP
24576:Atb20pkaCqT5TBWgNQ7a5r9eU1q1ndOeBJ4OlOO5qVm7qv6A:JVg5tQ7a3eU1qZdR+Ool5
Malware Config
Extracted
Family
netwire
C2
ihracat.myq-see.com:5770
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
2020-Clienst
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
hsFkbJUl
-
offline_keylogger
true
-
password
backdooR1
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 2 IoCs
resource yara_rule behavioral1/memory/432-16-0x0000000000400000-0x0000000000430000-memory.dmp netwire behavioral1/memory/432-17-0x0000000000400000-0x0000000000430000-memory.dmp netwire -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bootcfg.url UNICEF COVID-19 APP.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1616 set thread context of 432 1616 UNICEF COVID-19 APP.exe 95 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1616 UNICEF COVID-19 APP.exe 1616 UNICEF COVID-19 APP.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1224 taskmgr.exe Token: SeSystemProfilePrivilege 1224 taskmgr.exe Token: SeCreateGlobalPrivilege 1224 taskmgr.exe Token: 33 1224 taskmgr.exe Token: SeIncBasePriorityPrivilege 1224 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 1616 UNICEF COVID-19 APP.exe 1616 UNICEF COVID-19 APP.exe 1616 UNICEF COVID-19 APP.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 1616 UNICEF COVID-19 APP.exe 1616 UNICEF COVID-19 APP.exe 1616 UNICEF COVID-19 APP.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1616 wrote to memory of 2848 1616 UNICEF COVID-19 APP.exe 94 PID 1616 wrote to memory of 2848 1616 UNICEF COVID-19 APP.exe 94 PID 1616 wrote to memory of 2848 1616 UNICEF COVID-19 APP.exe 94 PID 1616 wrote to memory of 432 1616 UNICEF COVID-19 APP.exe 95 PID 1616 wrote to memory of 432 1616 UNICEF COVID-19 APP.exe 95 PID 1616 wrote to memory of 432 1616 UNICEF COVID-19 APP.exe 95 PID 1616 wrote to memory of 432 1616 UNICEF COVID-19 APP.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\UNICEF COVID-19 APP.exe"C:\Users\Admin\AppData\Local\Temp\UNICEF COVID-19 APP.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵PID:2848
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵PID:432
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1224