Analysis
-
max time kernel
114s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 04:16
Static task
static1
Behavioral task
behavioral1
Sample
a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe
Resource
win10v2004-20220414-en
General
-
Target
a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe
-
Size
692KB
-
MD5
5f3f6541b597489824e0f8f78cf0586d
-
SHA1
83776cf80cddc0c6d40ee254f102c9810d29354b
-
SHA256
a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a
-
SHA512
c372896eed2b72c615d7f45fae78adb90ce97c676bb54f06f419060b6a094e81829260d6684622870fdc8d7b6bce00403f9420fbc77ea000beca93a795091d23
Malware Config
Extracted
netwire
79.134.225.120:8765
-
activex_autorun
true
-
activex_key
{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
true
-
startup_name
win01
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4408-140-0x0000000000400000-0x00000000004AD000-memory.dmp netwire behavioral2/memory/4408-141-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1580 Host.exe 2516 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win01 = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exea843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exeHost.exeHost.exepid process 4480 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe 4408 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe 4408 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe 1580 Host.exe 2516 Host.exe 2516 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exeHost.exedescription pid process target process PID 4480 set thread context of 4408 4480 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe PID 1580 set thread context of 2516 1580 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exeHost.exepid process 4480 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe 1580 Host.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exea843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exeHost.exedescription pid process target process PID 4480 wrote to memory of 4408 4480 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe PID 4480 wrote to memory of 4408 4480 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe PID 4480 wrote to memory of 4408 4480 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe PID 4408 wrote to memory of 1580 4408 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe Host.exe PID 4408 wrote to memory of 1580 4408 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe Host.exe PID 4408 wrote to memory of 1580 4408 a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe Host.exe PID 1580 wrote to memory of 2516 1580 Host.exe Host.exe PID 1580 wrote to memory of 2516 1580 Host.exe Host.exe PID 1580 wrote to memory of 2516 1580 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe"C:\Users\Admin\AppData\Local\Temp\a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe"C:\Users\Admin\AppData\Local\Temp\a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
692KB
MD55f3f6541b597489824e0f8f78cf0586d
SHA183776cf80cddc0c6d40ee254f102c9810d29354b
SHA256a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a
SHA512c372896eed2b72c615d7f45fae78adb90ce97c676bb54f06f419060b6a094e81829260d6684622870fdc8d7b6bce00403f9420fbc77ea000beca93a795091d23
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
692KB
MD55f3f6541b597489824e0f8f78cf0586d
SHA183776cf80cddc0c6d40ee254f102c9810d29354b
SHA256a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a
SHA512c372896eed2b72c615d7f45fae78adb90ce97c676bb54f06f419060b6a094e81829260d6684622870fdc8d7b6bce00403f9420fbc77ea000beca93a795091d23
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
692KB
MD55f3f6541b597489824e0f8f78cf0586d
SHA183776cf80cddc0c6d40ee254f102c9810d29354b
SHA256a843fb8ba0b2f29a7ff14ec5bf25d6819507ba273356a8f09778b44a0a9a715a
SHA512c372896eed2b72c615d7f45fae78adb90ce97c676bb54f06f419060b6a094e81829260d6684622870fdc8d7b6bce00403f9420fbc77ea000beca93a795091d23
-
memory/1580-160-0x0000000077C10000-0x0000000077DB3000-memory.dmpFilesize
1.6MB
-
memory/1580-159-0x00000000021C0000-0x00000000021CE000-memory.dmpFilesize
56KB
-
memory/1580-156-0x0000000077C10000-0x0000000077DB3000-memory.dmpFilesize
1.6MB
-
memory/1580-147-0x0000000000000000-mapping.dmp
-
memory/1580-155-0x00007FFAC92D0000-0x00007FFAC94C5000-memory.dmpFilesize
2.0MB
-
memory/2516-170-0x00000000005C0000-0x00000000005CE000-memory.dmpFilesize
56KB
-
memory/2516-169-0x0000000077C10000-0x0000000077DB3000-memory.dmpFilesize
1.6MB
-
memory/2516-168-0x00007FFAC92D0000-0x00007FFAC94C5000-memory.dmpFilesize
2.0MB
-
memory/2516-157-0x0000000000000000-mapping.dmp
-
memory/4408-140-0x0000000000400000-0x00000000004AD000-memory.dmpFilesize
692KB
-
memory/4408-154-0x0000000077C10000-0x0000000077DB3000-memory.dmpFilesize
1.6MB
-
memory/4408-153-0x00007FFAC92D0000-0x00007FFAC94C5000-memory.dmpFilesize
2.0MB
-
memory/4408-141-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4408-135-0x0000000000000000-mapping.dmp
-
memory/4408-139-0x0000000077C10000-0x0000000077DB3000-memory.dmpFilesize
1.6MB
-
memory/4408-138-0x00007FFAC92D0000-0x00007FFAC94C5000-memory.dmpFilesize
2.0MB
-
memory/4408-150-0x0000000001F70000-0x0000000001F7E000-memory.dmpFilesize
56KB
-
memory/4480-136-0x00000000028A0000-0x00000000028AE000-memory.dmpFilesize
56KB
-
memory/4480-134-0x0000000077C10000-0x0000000077DB3000-memory.dmpFilesize
1.6MB
-
memory/4480-132-0x00000000028A0000-0x00000000028AE000-memory.dmpFilesize
56KB
-
memory/4480-137-0x0000000077C10000-0x0000000077DB3000-memory.dmpFilesize
1.6MB
-
memory/4480-133-0x00007FFAC92D0000-0x00007FFAC94C5000-memory.dmpFilesize
2.0MB