Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 21:48
Static task
static1
Behavioral task
behavioral1
Sample
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe
Resource
win10v2004-20220414-en
General
-
Target
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe
-
Size
160KB
-
MD5
a6b3b195fc729456c47573cc58f7b420
-
SHA1
1a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
-
SHA256
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
-
SHA512
eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
Malware Config
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4128-132-0x0000000000000000-mapping.dmp netwire behavioral2/memory/4128-133-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/4128-135-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/4128-138-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/1320-149-0x0000000000000000-mapping.dmp netwire behavioral2/memory/1320-155-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 1860 iexplore.exe 1320 iexplore.exe -
Modifies Installed Components in the registry 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplore = "C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\iexplore.exe" iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exeiexplore.exedescription pid process target process PID 2176 set thread context of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 1860 set thread context of 1320 1860 iexplore.exe iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exeiexplore.exepid process 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 1860 iexplore.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exeiexplore.exedescription pid process target process PID 2176 wrote to memory of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 2176 wrote to memory of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 2176 wrote to memory of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 2176 wrote to memory of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 2176 wrote to memory of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 2176 wrote to memory of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 2176 wrote to memory of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 2176 wrote to memory of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 2176 wrote to memory of 4128 2176 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe PID 4128 wrote to memory of 1860 4128 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe iexplore.exe PID 4128 wrote to memory of 1860 4128 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe iexplore.exe PID 4128 wrote to memory of 1860 4128 5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe iexplore.exe PID 1860 wrote to memory of 1320 1860 iexplore.exe iexplore.exe PID 1860 wrote to memory of 1320 1860 iexplore.exe iexplore.exe PID 1860 wrote to memory of 1320 1860 iexplore.exe iexplore.exe PID 1860 wrote to memory of 1320 1860 iexplore.exe iexplore.exe PID 1860 wrote to memory of 1320 1860 iexplore.exe iexplore.exe PID 1860 wrote to memory of 1320 1860 iexplore.exe iexplore.exe PID 1860 wrote to memory of 1320 1860 iexplore.exe iexplore.exe PID 1860 wrote to memory of 1320 1860 iexplore.exe iexplore.exe PID 1860 wrote to memory of 1320 1860 iexplore.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe"C:\Users\Admin\AppData\Local\Temp\5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe"C:\Users\Admin\AppData\Local\Temp\5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exeFilesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exeFilesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exeFilesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
memory/1320-155-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1320-149-0x0000000000000000-mapping.dmp
-
memory/1860-144-0x0000000000722000-0x0000000000727000-memory.dmpFilesize
20KB
-
memory/1860-142-0x0000000000722000-0x0000000000727000-memory.dmpFilesize
20KB
-
memory/1860-143-0x0000000000722000-0x0000000000727000-memory.dmpFilesize
20KB
-
memory/1860-145-0x0000000000722000-0x0000000000727000-memory.dmpFilesize
20KB
-
memory/1860-146-0x0000000000722000-0x0000000000727000-memory.dmpFilesize
20KB
-
memory/1860-147-0x0000000000722000-0x0000000000727000-memory.dmpFilesize
20KB
-
memory/1860-148-0x0000000000722000-0x0000000000727000-memory.dmpFilesize
20KB
-
memory/1860-136-0x0000000000000000-mapping.dmp
-
memory/1860-151-0x0000000000722000-0x0000000000727000-memory.dmpFilesize
20KB
-
memory/4128-138-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4128-132-0x0000000000000000-mapping.dmp
-
memory/4128-135-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4128-133-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB