Analysis
-
max time kernel
99s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 18:08
Static task
static1
Behavioral task
behavioral1
Sample
3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe
Resource
win10v2004-20220414-en
General
-
Target
3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe
-
Size
716KB
-
MD5
e704933324d92d41acc937844de96af2
-
SHA1
3d932cee05a86b2513aabf5b0ead5d317e287b7d
-
SHA256
3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de
-
SHA512
bbc82468099c4cc8b69baf295f3b6256872ddb84fa31abdffabfefd91e4488e6f1594000cc67adf8e6c58bee15055a32106f3d326d035ccdf4d91593999cba50
Malware Config
Extracted
netwire
79.134.225.120:8765
-
activex_autorun
true
-
activex_key
{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
true
-
startup_name
win01
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3348-141-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/3348-139-0x0000000000400000-0x00000000004B3000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 3816 Host.exe 396 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win01 = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exeHost.exeHost.exepid process 3376 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe 3348 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe 3348 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe 3816 Host.exe 396 Host.exe 396 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exeHost.exedescription pid process target process PID 3376 set thread context of 3348 3376 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe PID 3816 set thread context of 396 3816 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exeHost.exepid process 3376 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe 3816 Host.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exeHost.exedescription pid process target process PID 3376 wrote to memory of 3348 3376 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe PID 3376 wrote to memory of 3348 3376 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe PID 3376 wrote to memory of 3348 3376 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe PID 3348 wrote to memory of 3816 3348 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe Host.exe PID 3348 wrote to memory of 3816 3348 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe Host.exe PID 3348 wrote to memory of 3816 3348 3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe Host.exe PID 3816 wrote to memory of 396 3816 Host.exe Host.exe PID 3816 wrote to memory of 396 3816 Host.exe Host.exe PID 3816 wrote to memory of 396 3816 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe"C:\Users\Admin\AppData\Local\Temp\3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe"C:\Users\Admin\AppData\Local\Temp\3b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
716KB
MD5e704933324d92d41acc937844de96af2
SHA13d932cee05a86b2513aabf5b0ead5d317e287b7d
SHA2563b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de
SHA512bbc82468099c4cc8b69baf295f3b6256872ddb84fa31abdffabfefd91e4488e6f1594000cc67adf8e6c58bee15055a32106f3d326d035ccdf4d91593999cba50
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
716KB
MD5e704933324d92d41acc937844de96af2
SHA13d932cee05a86b2513aabf5b0ead5d317e287b7d
SHA2563b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de
SHA512bbc82468099c4cc8b69baf295f3b6256872ddb84fa31abdffabfefd91e4488e6f1594000cc67adf8e6c58bee15055a32106f3d326d035ccdf4d91593999cba50
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
716KB
MD5e704933324d92d41acc937844de96af2
SHA13d932cee05a86b2513aabf5b0ead5d317e287b7d
SHA2563b00fdabb7752fe2915425f6bb7d2bf90e36611fac730c9deb194d079d08a2de
SHA512bbc82468099c4cc8b69baf295f3b6256872ddb84fa31abdffabfefd91e4488e6f1594000cc67adf8e6c58bee15055a32106f3d326d035ccdf4d91593999cba50
-
memory/396-171-0x0000000077980000-0x0000000077B23000-memory.dmpFilesize
1.6MB
-
memory/396-170-0x00007FFC98F50000-0x00007FFC99145000-memory.dmpFilesize
2.0MB
-
memory/396-164-0x0000000077980000-0x0000000077B23000-memory.dmpFilesize
1.6MB
-
memory/396-162-0x00007FFC98F50000-0x00007FFC99145000-memory.dmpFilesize
2.0MB
-
memory/396-157-0x0000000000000000-mapping.dmp
-
memory/3348-141-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3348-140-0x00007FFC98F50000-0x00007FFC99145000-memory.dmpFilesize
2.0MB
-
memory/3348-139-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/3348-142-0x0000000077980000-0x0000000077B23000-memory.dmpFilesize
1.6MB
-
memory/3348-151-0x00000000005D0000-0x00000000005DF000-memory.dmpFilesize
60KB
-
memory/3348-153-0x00007FFC98F50000-0x00007FFC99145000-memory.dmpFilesize
2.0MB
-
memory/3348-155-0x0000000077980000-0x0000000077B23000-memory.dmpFilesize
1.6MB
-
memory/3348-135-0x0000000000000000-mapping.dmp
-
memory/3376-134-0x00000000021F0000-0x00000000021FF000-memory.dmpFilesize
60KB
-
memory/3376-138-0x0000000077980000-0x0000000077B23000-memory.dmpFilesize
1.6MB
-
memory/3376-137-0x00007FFC98F50000-0x00007FFC99145000-memory.dmpFilesize
2.0MB
-
memory/3376-136-0x00000000021F0000-0x00000000021FF000-memory.dmpFilesize
60KB
-
memory/3816-158-0x0000000077980000-0x0000000077B23000-memory.dmpFilesize
1.6MB
-
memory/3816-148-0x0000000000000000-mapping.dmp
-
memory/3816-160-0x0000000002140000-0x000000000214F000-memory.dmpFilesize
60KB
-
memory/3816-156-0x00007FFC98F50000-0x00007FFC99145000-memory.dmpFilesize
2.0MB