Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 23:27
Static task
static1
Behavioral task
behavioral1
Sample
376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe
-
Size
1.1MB
-
MD5
0b0cef96675cd85fdbbe3e8968cbf924
-
SHA1
4db5d5b0425e5b83224fa6b3611385edfe314d20
-
SHA256
376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f
-
SHA512
b7e3805e7c184405973684e68235ab68bebcf050d70c68901d14f2c9b489baca481b956517151e42dcf59ca6d1a1348e1a33f47766f15459ce00360e59642e07
Malware Config
Extracted
Family
netwire
C2
79.134.225.73:1968
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
pd1n9
-
lock_executable
false
-
mutex
KHAtGUwc
-
offline_keylogger
false
-
password
Kimbolsapoq!P13
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4188-132-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/4188-141-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Drops startup file 1 IoCs
Processes:
376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PerceptionSimulationDevice.url 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exedescription pid process target process PID 4220 set thread context of 4188 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exepid process 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exepid process 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exepid process 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exedescription pid process target process PID 4220 wrote to memory of 4188 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe svchost.exe PID 4220 wrote to memory of 4188 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe svchost.exe PID 4220 wrote to memory of 4188 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe svchost.exe PID 4220 wrote to memory of 4188 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe svchost.exe PID 4220 wrote to memory of 4188 4220 376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe"C:\Users\Admin\AppData\Local\Temp\376523db4ccd1d021aa65208e85a665dcd1f83dbed024c1d1c0bb1d0bb24dd4f.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4188-131-0x0000000000000000-mapping.dmp
-
memory/4188-132-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4188-141-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4220-130-0x0000000000F90000-0x0000000000FB2000-memory.dmpFilesize
136KB