Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 21:48
Static task
static1
Behavioral task
behavioral1
Sample
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe
Resource
win10v2004-20220414-en
General
-
Target
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe
-
Size
160KB
-
MD5
a6b3b195fc729456c47573cc58f7b420
-
SHA1
1a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
-
SHA256
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
-
SHA512
eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
Malware Config
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/964-56-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/964-57-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/964-60-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/964-64-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/104-72-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/104-77-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 1832 iexplore.exe 104 iexplore.exe -
Modifies Installed Components in the registry 2 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exepid process 964 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 964 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\iexplore = "C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\iexplore.exe" iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exeiexplore.exedescription pid process target process PID 904 set thread context of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 1832 set thread context of 104 1832 iexplore.exe iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exeiexplore.exepid process 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 1832 iexplore.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exeiexplore.exedescription pid process target process PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 904 wrote to memory of 964 904 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 964 wrote to memory of 1832 964 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe iexplore.exe PID 964 wrote to memory of 1832 964 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe iexplore.exe PID 964 wrote to memory of 1832 964 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe iexplore.exe PID 964 wrote to memory of 1832 964 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe PID 1832 wrote to memory of 104 1832 iexplore.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe"C:\Users\Admin\AppData\Local\Temp\5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe"C:\Users\Admin\AppData\Local\Temp\5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exeFilesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exeFilesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exeFilesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
\Users\Admin\AppData\Roaming\microsofts\iexplore.exeFilesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
\Users\Admin\AppData\Roaming\microsofts\iexplore.exeFilesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
memory/104-72-0x00000000004021DA-mapping.dmp
-
memory/104-77-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/964-57-0x00000000004021DA-mapping.dmp
-
memory/964-59-0x00000000751C1000-0x00000000751C3000-memory.dmpFilesize
8KB
-
memory/964-60-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/964-56-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/964-64-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1832-63-0x0000000000000000-mapping.dmp
-
memory/1832-66-0x0000000000430000-0x0000000000583000-memory.dmpFilesize
1.3MB