Analysis
-
max time kernel
151s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 05:14
Static task
static1
Behavioral task
behavioral1
Sample
4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe
Resource
win10v2004-20220414-en
General
-
Target
4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe
-
Size
431KB
-
MD5
839a358056109761a9323444b0fd7984
-
SHA1
a82b91764532cbc42d96b98b096cefc0f4e21ede
-
SHA256
4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d
-
SHA512
5f6dd1ab2f5925e4fb15b810ea541d54e7a0748c2995b8b832b6f43c1acf4eacb673af65a149ee13fb54a86971f0034e60706f8dd894bf037e9937fe761fe386
Malware Config
Extracted
netwire
harromex.com:4020
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
true
-
host_id
Grace
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
qofiTxIi
-
offline_keylogger
true
-
password
niconpay$
-
registry_autorun
true
-
startup_name
Netwire
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4452-137-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4452-139-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4452-143-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1152-150-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1152-151-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 3 IoCs
Processes:
Host.exeHost.exeHost.exepid process 3312 Host.exe 4268 Host.exe 1152 Host.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netwire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exeHost.exedescription pid process target process PID 3504 set thread context of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3312 set thread context of 1152 3312 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exeHost.exepid process 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 3312 Host.exe 3312 Host.exe 3312 Host.exe 3312 Host.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exeHost.exedescription pid process Token: SeDebugPrivilege 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe Token: SeDebugPrivilege 3312 Host.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exeHost.exedescription pid process target process PID 3504 wrote to memory of 4860 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4860 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4860 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 3504 wrote to memory of 4452 3504 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe PID 4452 wrote to memory of 3312 4452 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe Host.exe PID 4452 wrote to memory of 3312 4452 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe Host.exe PID 4452 wrote to memory of 3312 4452 4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe Host.exe PID 3312 wrote to memory of 4268 3312 Host.exe Host.exe PID 3312 wrote to memory of 4268 3312 Host.exe Host.exe PID 3312 wrote to memory of 4268 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe PID 3312 wrote to memory of 1152 3312 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe"C:\Users\Admin\AppData\Local\Temp\4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe"{path}"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\4d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
431KB
MD5839a358056109761a9323444b0fd7984
SHA1a82b91764532cbc42d96b98b096cefc0f4e21ede
SHA2564d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d
SHA5125f6dd1ab2f5925e4fb15b810ea541d54e7a0748c2995b8b832b6f43c1acf4eacb673af65a149ee13fb54a86971f0034e60706f8dd894bf037e9937fe761fe386
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
431KB
MD5839a358056109761a9323444b0fd7984
SHA1a82b91764532cbc42d96b98b096cefc0f4e21ede
SHA2564d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d
SHA5125f6dd1ab2f5925e4fb15b810ea541d54e7a0748c2995b8b832b6f43c1acf4eacb673af65a149ee13fb54a86971f0034e60706f8dd894bf037e9937fe761fe386
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
431KB
MD5839a358056109761a9323444b0fd7984
SHA1a82b91764532cbc42d96b98b096cefc0f4e21ede
SHA2564d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d
SHA5125f6dd1ab2f5925e4fb15b810ea541d54e7a0748c2995b8b832b6f43c1acf4eacb673af65a149ee13fb54a86971f0034e60706f8dd894bf037e9937fe761fe386
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
431KB
MD5839a358056109761a9323444b0fd7984
SHA1a82b91764532cbc42d96b98b096cefc0f4e21ede
SHA2564d57cb5106534f8239619dcf140f491c45759cd5b632ca36fe9941a9cb19176d
SHA5125f6dd1ab2f5925e4fb15b810ea541d54e7a0748c2995b8b832b6f43c1acf4eacb673af65a149ee13fb54a86971f0034e60706f8dd894bf037e9937fe761fe386
-
memory/1152-146-0x0000000000000000-mapping.dmp
-
memory/1152-151-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1152-150-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3312-140-0x0000000000000000-mapping.dmp
-
memory/3504-130-0x0000000000D10000-0x0000000000D82000-memory.dmpFilesize
456KB
-
memory/3504-134-0x0000000007D60000-0x0000000007DFC000-memory.dmpFilesize
624KB
-
memory/3504-133-0x0000000007AD0000-0x0000000007ADA000-memory.dmpFilesize
40KB
-
memory/3504-132-0x0000000007AF0000-0x0000000007B82000-memory.dmpFilesize
584KB
-
memory/3504-131-0x0000000007FC0000-0x0000000008564000-memory.dmpFilesize
5.6MB
-
memory/4268-144-0x0000000000000000-mapping.dmp
-
memory/4452-139-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4452-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4452-137-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4452-136-0x0000000000000000-mapping.dmp
-
memory/4860-135-0x0000000000000000-mapping.dmp