Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 11:58
Static task
static1
Behavioral task
behavioral1
Sample
9cdb3ec1accd17e884e8ed76d8789b2b.exe
Resource
win7v20201028
General
-
Target
9cdb3ec1accd17e884e8ed76d8789b2b.exe
-
Size
459KB
-
MD5
95b26096376f1a1624581f3203a05f4d
-
SHA1
5e885913d272cb5912bd2bbb1f84be93ac09bf52
-
SHA256
3cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf
-
SHA512
c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53
Malware Config
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-1-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2040-2-0x000000000040242D-mapping.dmp netwire behavioral1/memory/2040-4-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1756-19-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1756-15-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1336-23-0x000000000040242D-mapping.dmp netwire -
Executes dropped EXE 3 IoCs
Processes:
Host.exeHost.exeHost.exepid process 1216 Host.exe 1756 Host.exe 1688 Host.exe -
Processes:
resource yara_rule behavioral1/memory/484-0-0x0000000000400000-0x00000000004FF000-memory.dmp upx behavioral1/memory/1172-5-0x0000000000400000-0x00000000004FF000-memory.dmp upx \Users\Admin\AppData\Roaming\Install\Host.exe upx \Users\Admin\AppData\Roaming\Install\Host.exe upx C:\Users\Admin\AppData\Roaming\Install\Host.exe upx behavioral1/memory/1216-10-0x0000000000400000-0x00000000004FF000-memory.dmp upx \Users\Admin\AppData\Roaming\Install\Host.exe upx C:\Users\Admin\AppData\Roaming\Install\Host.exe upx \Users\Admin\AppData\Roaming\Install\Host.exe upx C:\Users\Admin\AppData\Roaming\Install\Host.exe upx C:\Users\Admin\AppData\Roaming\Install\Host.exe upx behavioral1/memory/1728-21-0x0000000000400000-0x00000000004FF000-memory.dmp upx behavioral1/memory/1688-24-0x0000000000400000-0x00000000004FF000-memory.dmp upx behavioral1/memory/1368-27-0x0000000000400000-0x00000000004FF000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
9cdb3ec1accd17e884e8ed76d8789b2b.exeHost.exepid process 2040 9cdb3ec1accd17e884e8ed76d8789b2b.exe 2040 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1216 Host.exe 1216 Host.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Host.exe9cdb3ec1accd17e884e8ed76d8789b2b.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 9cdb3ec1accd17e884e8ed76d8789b2b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9cdb3ec1accd17e884e8ed76d8789b2b.exe" 9cdb3ec1accd17e884e8ed76d8789b2b.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9cdb3ec1accd17e884e8ed76d8789b2b.exeHost.exe9cdb3ec1accd17e884e8ed76d8789b2b.exedescription pid process target process PID 484 set thread context of 2040 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1216 set thread context of 1756 1216 Host.exe Host.exe PID 1728 set thread context of 1336 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe -
Suspicious behavior: EnumeratesProcesses 1599 IoCs
Processes:
9cdb3ec1accd17e884e8ed76d8789b2b.exe9cdb3ec1accd17e884e8ed76d8789b2b.exeHost.exe9cdb3ec1accd17e884e8ed76d8789b2b.exeHost.exe9cdb3ec1accd17e884e8ed76d8789b2b.exepid process 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1172 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1172 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1172 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1172 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1172 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1216 Host.exe 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1688 Host.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe 1368 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1688 Host.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
9cdb3ec1accd17e884e8ed76d8789b2b.exeHost.exe9cdb3ec1accd17e884e8ed76d8789b2b.exepid process 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 1216 Host.exe 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
9cdb3ec1accd17e884e8ed76d8789b2b.exe9cdb3ec1accd17e884e8ed76d8789b2b.exeHost.exe9cdb3ec1accd17e884e8ed76d8789b2b.exe9cdb3ec1accd17e884e8ed76d8789b2b.exedescription pid process target process PID 484 wrote to memory of 2040 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 484 wrote to memory of 2040 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 484 wrote to memory of 2040 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 484 wrote to memory of 2040 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 484 wrote to memory of 1172 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 484 wrote to memory of 1172 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 484 wrote to memory of 1172 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 484 wrote to memory of 1172 484 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 2040 wrote to memory of 1216 2040 9cdb3ec1accd17e884e8ed76d8789b2b.exe Host.exe PID 2040 wrote to memory of 1216 2040 9cdb3ec1accd17e884e8ed76d8789b2b.exe Host.exe PID 2040 wrote to memory of 1216 2040 9cdb3ec1accd17e884e8ed76d8789b2b.exe Host.exe PID 2040 wrote to memory of 1216 2040 9cdb3ec1accd17e884e8ed76d8789b2b.exe Host.exe PID 1216 wrote to memory of 1756 1216 Host.exe Host.exe PID 1216 wrote to memory of 1756 1216 Host.exe Host.exe PID 1216 wrote to memory of 1756 1216 Host.exe Host.exe PID 1216 wrote to memory of 1756 1216 Host.exe Host.exe PID 1172 wrote to memory of 1728 1172 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1172 wrote to memory of 1728 1172 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1172 wrote to memory of 1728 1172 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1172 wrote to memory of 1728 1172 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1216 wrote to memory of 1688 1216 Host.exe Host.exe PID 1216 wrote to memory of 1688 1216 Host.exe Host.exe PID 1216 wrote to memory of 1688 1216 Host.exe Host.exe PID 1216 wrote to memory of 1688 1216 Host.exe Host.exe PID 1728 wrote to memory of 1336 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1728 wrote to memory of 1336 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1728 wrote to memory of 1336 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1728 wrote to memory of 1336 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1728 wrote to memory of 1368 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1728 wrote to memory of 1368 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1728 wrote to memory of 1368 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe PID 1728 wrote to memory of 1368 1728 9cdb3ec1accd17e884e8ed76d8789b2b.exe 9cdb3ec1accd17e884e8ed76d8789b2b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" 2 1756 2592657364⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe" 2 2040 2592647852⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe"C:\Users\Admin\AppData\Local\Temp\9cdb3ec1accd17e884e8ed76d8789b2b.exe" 2 1336 2592658924⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b26096376f1a1624581f3203a05f4d
SHA15e885913d272cb5912bd2bbb1f84be93ac09bf52
SHA2563cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf
SHA512c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b26096376f1a1624581f3203a05f4d
SHA15e885913d272cb5912bd2bbb1f84be93ac09bf52
SHA2563cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf
SHA512c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b26096376f1a1624581f3203a05f4d
SHA15e885913d272cb5912bd2bbb1f84be93ac09bf52
SHA2563cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf
SHA512c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b26096376f1a1624581f3203a05f4d
SHA15e885913d272cb5912bd2bbb1f84be93ac09bf52
SHA2563cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf
SHA512c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53
-
\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b26096376f1a1624581f3203a05f4d
SHA15e885913d272cb5912bd2bbb1f84be93ac09bf52
SHA2563cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf
SHA512c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53
-
\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b26096376f1a1624581f3203a05f4d
SHA15e885913d272cb5912bd2bbb1f84be93ac09bf52
SHA2563cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf
SHA512c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53
-
\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b26096376f1a1624581f3203a05f4d
SHA15e885913d272cb5912bd2bbb1f84be93ac09bf52
SHA2563cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf
SHA512c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53
-
\Users\Admin\AppData\Roaming\Install\Host.exeMD5
95b26096376f1a1624581f3203a05f4d
SHA15e885913d272cb5912bd2bbb1f84be93ac09bf52
SHA2563cb34cca32bb4aea5625d0760bd6c51f71695c7bb2c11e465c24a31efbfba6cf
SHA512c49bb53a7e180761011fad7f3b987ced91e52715bc27382c7600d086bfbcb893c21361028941b29b2fb0e6abe2da47a79a222098efc8801ed6f218def7599f53
-
memory/484-0-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1172-3-0x0000000000000000-mapping.dmp
-
memory/1172-5-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1216-8-0x0000000000000000-mapping.dmp
-
memory/1216-10-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1336-23-0x000000000040242D-mapping.dmp
-
memory/1368-25-0x0000000000000000-mapping.dmp
-
memory/1368-27-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1688-24-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1688-18-0x0000000000000000-mapping.dmp
-
memory/1728-13-0x0000000000000000-mapping.dmp
-
memory/1728-21-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1756-19-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1756-15-0x000000000040242D-mapping.dmp
-
memory/2040-1-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2040-2-0x000000000040242D-mapping.dmp
-
memory/2040-4-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB