Analysis
- max time kernel
55s - max time network
67s - platform
windows7_x64 - resource
win7 - submitted
24/06/2020, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe
- Size 223KB
- Sample200624-xmvsdeer76
- SHA256 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f
- MD5 58dd12db0aa525a52efbb4ebbb00a397
- SHA1 6ee3dc0ada96ac9c8dd516c27f485189e45d3f9f
- SHA512 1741aaddd3a25aab64f758cd68f9b9ddcf8863da0bdb96cd507eba69862de7cabd87c39cd2c151e7274a95559b78b49954542dab895e572346ba9a57928f2d27
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 112 set thread context of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 - NetWire RAT payload 2 IoCs
resource yara_rule behavioral1/memory/780-1-0x0000000000400000-0x0000000000430000-memory.dmp netwire behavioral1/memory/780-4-0x0000000000400000-0x0000000000430000-memory.dmp netwire - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 112 wrote to memory of 780 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 24 PID 780 wrote to memory of 1072 780 svhost.exe 26 PID 780 wrote to memory of 1072 780 svhost.exe 26 PID 780 wrote to memory of 1072 780 svhost.exe 26 PID 780 wrote to memory of 1072 780 svhost.exe 26 PID 112 wrote to memory of 1088 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 25 PID 112 wrote to memory of 1088 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 25 PID 112 wrote to memory of 1088 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 25 PID 112 wrote to memory of 1088 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 25 PID 112 wrote to memory of 1824 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 29 PID 112 wrote to memory of 1824 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 29 PID 112 wrote to memory of 1824 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 29 PID 112 wrote to memory of 1824 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 29 PID 1824 wrote to memory of 1856 1824 cmd.exe 31 PID 1824 wrote to memory of 1856 1824 cmd.exe 31 PID 1824 wrote to memory of 1856 1824 cmd.exe 31 PID 1824 wrote to memory of 1856 1824 cmd.exe 31 PID 112 wrote to memory of 1236 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 32 PID 112 wrote to memory of 1236 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 32 PID 112 wrote to memory of 1236 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 32 PID 112 wrote to memory of 1236 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 32 PID 112 wrote to memory of 1892 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 34 PID 112 wrote to memory of 1892 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 34 PID 112 wrote to memory of 1892 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 34 PID 112 wrote to memory of 1892 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 34 PID 1892 wrote to memory of 1932 1892 cmd.exe 36 PID 1892 wrote to memory of 1932 1892 cmd.exe 36 PID 1892 wrote to memory of 1932 1892 cmd.exe 36 PID 1892 wrote to memory of 1932 1892 cmd.exe 36 - Executes dropped EXE 2 IoCs
pid Process 780 svhost.exe 1072 Host.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1932 timeout.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe - Loads dropped DLL 3 IoCs
pid Process 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe 780 svhost.exe 112 894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe"C:\Users\Admin\AppData\Local\Temp\894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
PID:1072
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f.exe" "%temp%\FolderN\name.exe" /Y2⤵PID:1088
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵PID:1856
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
PID:1236
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
PID:1932
-
-