Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 04:17
Static task
static1
Behavioral task
behavioral1
Sample
3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe
-
Size
1.2MB
-
MD5
c9a5eb3649bee27da9e4705bd49b3bb2
-
SHA1
19e28e7493f6cd69040c83df97a99c7ab94fa3e6
-
SHA256
3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc
-
SHA512
719105b5b60bfea751e59e88194708e16c0ca7c1615ccfa93d30c9a49d3a61bbe5096efff6ded4ce38cac0a21856e6f4542e30d2cc0a8ce1e6a220d3ac3eec37
Malware Config
Extracted
Family
netwire
C2
79.134.225.73:1968
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
pd1n9
-
lock_executable
false
-
mutex
KHAtGUwc
-
offline_keylogger
false
-
password
Kimbolsapoq!P13
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1768-58-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1768-66-0x0000000000402BCB-mapping.dmp netwire behavioral1/memory/1768-69-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Drops startup file 1 IoCs
Processes:
3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cabinet.url 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exedescription pid process target process PID 1520 set thread context of 1768 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe svchost.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exepid process 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exepid process 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exedescription pid process target process PID 1520 wrote to memory of 1768 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe svchost.exe PID 1520 wrote to memory of 1768 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe svchost.exe PID 1520 wrote to memory of 1768 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe svchost.exe PID 1520 wrote to memory of 1768 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe svchost.exe PID 1520 wrote to memory of 1768 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe svchost.exe PID 1520 wrote to memory of 1768 1520 3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe"C:\Users\Admin\AppData\Local\Temp\3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-54-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB
-
memory/1520-55-0x0000000000280000-0x00000000002A2000-memory.dmpFilesize
136KB
-
memory/1768-56-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1768-58-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1768-66-0x0000000000402BCB-mapping.dmp
-
memory/1768-69-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB