Analysis
-
max time kernel
109s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 03:13
Static task
static1
Behavioral task
behavioral1
Sample
5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe
Resource
win10v2004-20220414-en
General
-
Target
5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe
-
Size
580KB
-
MD5
2024f8a7ec2df07582ad0f2e982ddcdb
-
SHA1
d5ba5fb8e0be66cf77ef368179d5c21f790ca911
-
SHA256
5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb
-
SHA512
e14384b4f038ed34d7ca540382ac07a77df08cb865077e432f00a0d9a93152bb7264c476f1e33f3a95d75973d9c78c8a4ed167cc9ce10f8e82adf5b95d077c36
Malware Config
Extracted
netwire
79.134.225.120:8765
-
activex_autorun
true
-
activex_key
{L501JP3X-C6PC-RH36-475X-RS2C2OQHHGS0}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
true
-
startup_name
windows
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1120-66-0x0000000000400000-0x0000000000492000-memory.dmp netwire behavioral1/memory/1120-67-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1096-91-0x0000000000400000-0x0000000000492000-memory.dmp netwire behavioral1/memory/1096-92-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 2004 Host.exe 1096 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{L501JP3X-C6PC-RH36-475X-RS2C2OQHHGS0} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{L501JP3X-C6PC-RH36-475X-RS2C2OQHHGS0}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Loads dropped DLL 2 IoCs
Processes:
5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exepid process 1120 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 1120 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exeHost.exeHost.exepid process 1260 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 1120 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 1120 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 2004 Host.exe 1096 Host.exe 1096 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exeHost.exedescription pid process target process PID 1260 set thread context of 1120 1260 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe PID 2004 set thread context of 1096 2004 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exeHost.exepid process 1260 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 2004 Host.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exeHost.exedescription pid process target process PID 1260 wrote to memory of 1120 1260 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe PID 1260 wrote to memory of 1120 1260 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe PID 1260 wrote to memory of 1120 1260 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe PID 1260 wrote to memory of 1120 1260 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe PID 1120 wrote to memory of 2004 1120 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe Host.exe PID 1120 wrote to memory of 2004 1120 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe Host.exe PID 1120 wrote to memory of 2004 1120 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe Host.exe PID 1120 wrote to memory of 2004 1120 5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe Host.exe PID 2004 wrote to memory of 1096 2004 Host.exe Host.exe PID 2004 wrote to memory of 1096 2004 Host.exe Host.exe PID 2004 wrote to memory of 1096 2004 Host.exe Host.exe PID 2004 wrote to memory of 1096 2004 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe"C:\Users\Admin\AppData\Local\Temp\5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe"C:\Users\Admin\AppData\Local\Temp\5683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
580KB
MD52024f8a7ec2df07582ad0f2e982ddcdb
SHA1d5ba5fb8e0be66cf77ef368179d5c21f790ca911
SHA2565683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb
SHA512e14384b4f038ed34d7ca540382ac07a77df08cb865077e432f00a0d9a93152bb7264c476f1e33f3a95d75973d9c78c8a4ed167cc9ce10f8e82adf5b95d077c36
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
580KB
MD52024f8a7ec2df07582ad0f2e982ddcdb
SHA1d5ba5fb8e0be66cf77ef368179d5c21f790ca911
SHA2565683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb
SHA512e14384b4f038ed34d7ca540382ac07a77df08cb865077e432f00a0d9a93152bb7264c476f1e33f3a95d75973d9c78c8a4ed167cc9ce10f8e82adf5b95d077c36
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
580KB
MD52024f8a7ec2df07582ad0f2e982ddcdb
SHA1d5ba5fb8e0be66cf77ef368179d5c21f790ca911
SHA2565683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb
SHA512e14384b4f038ed34d7ca540382ac07a77df08cb865077e432f00a0d9a93152bb7264c476f1e33f3a95d75973d9c78c8a4ed167cc9ce10f8e82adf5b95d077c36
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
580KB
MD52024f8a7ec2df07582ad0f2e982ddcdb
SHA1d5ba5fb8e0be66cf77ef368179d5c21f790ca911
SHA2565683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb
SHA512e14384b4f038ed34d7ca540382ac07a77df08cb865077e432f00a0d9a93152bb7264c476f1e33f3a95d75973d9c78c8a4ed167cc9ce10f8e82adf5b95d077c36
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
580KB
MD52024f8a7ec2df07582ad0f2e982ddcdb
SHA1d5ba5fb8e0be66cf77ef368179d5c21f790ca911
SHA2565683c67bace862ceec5ecee12100ff01374445e2b5b1c2896dbb593cfc5e87cb
SHA512e14384b4f038ed34d7ca540382ac07a77df08cb865077e432f00a0d9a93152bb7264c476f1e33f3a95d75973d9c78c8a4ed167cc9ce10f8e82adf5b95d077c36
-
memory/1096-99-0x0000000000220000-0x000000000022D000-memory.dmpFilesize
52KB
-
memory/1096-98-0x0000000077760000-0x0000000077909000-memory.dmpFilesize
1.7MB
-
memory/1096-92-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1096-91-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/1096-85-0x000000000047AFAD-mapping.dmp
-
memory/1120-67-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1120-66-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/1120-61-0x000000000047AFAD-mapping.dmp
-
memory/1120-78-0x0000000077760000-0x0000000077909000-memory.dmpFilesize
1.7MB
-
memory/1120-77-0x00000000001B0000-0x00000000001BD000-memory.dmpFilesize
52KB
-
memory/1120-79-0x0000000077940000-0x0000000077AC0000-memory.dmpFilesize
1.5MB
-
memory/1260-60-0x0000000077940000-0x0000000077AC0000-memory.dmpFilesize
1.5MB
-
memory/1260-57-0x00000000753C1000-0x00000000753C3000-memory.dmpFilesize
8KB
-
memory/1260-56-0x0000000000230000-0x000000000023D000-memory.dmpFilesize
52KB
-
memory/1260-63-0x0000000077940000-0x0000000077AC0000-memory.dmpFilesize
1.5MB
-
memory/1260-62-0x0000000000230000-0x000000000023D000-memory.dmpFilesize
52KB
-
memory/1260-59-0x0000000077760000-0x0000000077909000-memory.dmpFilesize
1.7MB
-
memory/2004-87-0x0000000077760000-0x0000000077909000-memory.dmpFilesize
1.7MB
-
memory/2004-88-0x0000000077940000-0x0000000077AC0000-memory.dmpFilesize
1.5MB
-
memory/2004-75-0x0000000000000000-mapping.dmp