netwire | 1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276

General

Target

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
Size

1.9MB
MD5

981c378f3cd851641dceeebd67813eb2
SHA1

8a57f4750c4bc0fe9f7e81a40cb9aa8345024c32
SHA256

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276
SHA512

ee310207d3561f5bec513606cc543d5861745b09323952d4c1a10169a74e9967f17779298a79059d869b22aba655925acb36def827cd82b6ebb899921b94be65

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Extracted

Family

netwire

C2

timduck.duckdns.org:1194

Attributes

activex_autorun
false
copy_executable
true
delete_original
true
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
HXiMHiTC
offline_keylogger
true
password
Password
registry_autorun
true
startup_name
NetWire
use_mutex
true

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exeHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe\""	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

NetWire RAT payload 12 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/240-70-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral1/memory/240-69-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral1/memory/240-68-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral1/memory/240-73-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral1/memory/240-72-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral1/memory/240-74-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral1/memory/240-75-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/240-78-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral1/memory/240-83-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral1/memory/2008-106-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/2008-110-0x0000000000400000-0x0000000000434000-memory.dmp	netwire
behavioral1/memory/2008-111-0x0000000000400000-0x0000000000434000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 3 IoCs

Processes:

Host.exeHost.exeHost.exe

pid process

584 Host.exe
1520 Host.exe
2008 Host.exe

pid	process
584	Host.exe
1520	Host.exe
2008	Host.exe

Drops startup file 4 IoCs

Processes:

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exeHost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Host.exe	Host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Host.exe	Host.exe

Loads dropped DLL 2 IoCs

Processes:

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe

pid	process
240	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
240	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exeHost.exeHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe"	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe"	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

Processes:

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exeHost.exe

pid	process
1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
584	Host.exe
584	Host.exe
584	Host.exe
584	Host.exe
584	Host.exe
584	Host.exe
584	Host.exe
584	Host.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exeHost.exe

description	pid	process	target process
PID 1552 set thread context of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 584 set thread context of 2008	584	Host.exe	Host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 6 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

612 timeout.exe
2004 timeout.exe
1912 timeout.exe
604 timeout.exe
1312 timeout.exe
1280 timeout.exe

pid	process
612	timeout.exe
2004	timeout.exe
1912	timeout.exe
604	timeout.exe
1312	timeout.exe
1280	timeout.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exeHost.exe

pid	process
1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
584	Host.exe
584	Host.exe
584	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exeHost.exe

description	pid	process
Token: SeDebugPrivilege	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
Token: SeDebugPrivilege	584	Host.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.execmd.execmd.execmd.exe1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exeHost.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1552 wrote to memory of 1284	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1552 wrote to memory of 1284	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1552 wrote to memory of 1284	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1552 wrote to memory of 1284	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1284 wrote to memory of 1312	1284	cmd.exe	timeout.exe
PID 1284 wrote to memory of 1312	1284	cmd.exe	timeout.exe
PID 1284 wrote to memory of 1312	1284	cmd.exe	timeout.exe
PID 1284 wrote to memory of 1312	1284	cmd.exe	timeout.exe
PID 1552 wrote to memory of 1748	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1552 wrote to memory of 1748	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1552 wrote to memory of 1748	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1552 wrote to memory of 1748	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1748 wrote to memory of 1280	1748	cmd.exe	timeout.exe
PID 1748 wrote to memory of 1280	1748	cmd.exe	timeout.exe
PID 1748 wrote to memory of 1280	1748	cmd.exe	timeout.exe
PID 1748 wrote to memory of 1280	1748	cmd.exe	timeout.exe
PID 1552 wrote to memory of 1744	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1552 wrote to memory of 1744	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1552 wrote to memory of 1744	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1552 wrote to memory of 1744	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	cmd.exe
PID 1744 wrote to memory of 612	1744	cmd.exe	timeout.exe
PID 1744 wrote to memory of 612	1744	cmd.exe	timeout.exe
PID 1744 wrote to memory of 612	1744	cmd.exe	timeout.exe
PID 1744 wrote to memory of 612	1744	cmd.exe	timeout.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 1552 wrote to memory of 240	1552	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
PID 240 wrote to memory of 584	240	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	Host.exe
PID 240 wrote to memory of 584	240	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	Host.exe
PID 240 wrote to memory of 584	240	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	Host.exe
PID 240 wrote to memory of 584	240	1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe	Host.exe
PID 584 wrote to memory of 1968	584	Host.exe	cmd.exe
PID 584 wrote to memory of 1968	584	Host.exe	cmd.exe
PID 584 wrote to memory of 1968	584	Host.exe	cmd.exe
PID 584 wrote to memory of 1968	584	Host.exe	cmd.exe
PID 1968 wrote to memory of 2004	1968	cmd.exe	timeout.exe
PID 1968 wrote to memory of 2004	1968	cmd.exe	timeout.exe
PID 1968 wrote to memory of 2004	1968	cmd.exe	timeout.exe
PID 1968 wrote to memory of 2004	1968	cmd.exe	timeout.exe
PID 584 wrote to memory of 1988	584	Host.exe	cmd.exe
PID 584 wrote to memory of 1988	584	Host.exe	cmd.exe
PID 584 wrote to memory of 1988	584	Host.exe	cmd.exe
PID 584 wrote to memory of 1988	584	Host.exe	cmd.exe
PID 1988 wrote to memory of 1912	1988	cmd.exe	timeout.exe
PID 1988 wrote to memory of 1912	1988	cmd.exe	timeout.exe
PID 1988 wrote to memory of 1912	1988	cmd.exe	timeout.exe
PID 1988 wrote to memory of 1912	1988	cmd.exe	timeout.exe
PID 584 wrote to memory of 652	584	Host.exe	cmd.exe
PID 584 wrote to memory of 652	584	Host.exe	cmd.exe
PID 584 wrote to memory of 652	584	Host.exe	cmd.exe
PID 584 wrote to memory of 652	584	Host.exe	cmd.exe
PID 652 wrote to memory of 604	652	cmd.exe	timeout.exe
PID 652 wrote to memory of 604	652	cmd.exe	timeout.exe
PID 652 wrote to memory of 604	652	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
"C:\Users\Admin\AppData\Local\Temp\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1280

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:612

C:\Users\Admin\AppData\Local\Temp\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe
"C:\Users\Admin\AppData\Local\Temp\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:2004

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:1912

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:604

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
PID:1520

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.9MB

MD5
981c378f3cd851641dceeebd67813eb2

SHA1
8a57f4750c4bc0fe9f7e81a40cb9aa8345024c32

SHA256
1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276

SHA512
ee310207d3561f5bec513606cc543d5861745b09323952d4c1a10169a74e9967f17779298a79059d869b22aba655925acb36def827cd82b6ebb899921b94be65

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.9MB

MD5
981c378f3cd851641dceeebd67813eb2

SHA1
8a57f4750c4bc0fe9f7e81a40cb9aa8345024c32

SHA256
1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276

SHA512
ee310207d3561f5bec513606cc543d5861745b09323952d4c1a10169a74e9967f17779298a79059d869b22aba655925acb36def827cd82b6ebb899921b94be65

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.9MB

MD5
981c378f3cd851641dceeebd67813eb2

SHA1
8a57f4750c4bc0fe9f7e81a40cb9aa8345024c32

SHA256
1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276

SHA512
ee310207d3561f5bec513606cc543d5861745b09323952d4c1a10169a74e9967f17779298a79059d869b22aba655925acb36def827cd82b6ebb899921b94be65

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.9MB

MD5
981c378f3cd851641dceeebd67813eb2

SHA1
8a57f4750c4bc0fe9f7e81a40cb9aa8345024c32

SHA256
1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276

SHA512
ee310207d3561f5bec513606cc543d5861745b09323952d4c1a10169a74e9967f17779298a79059d869b22aba655925acb36def827cd82b6ebb899921b94be65

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.9MB

MD5
981c378f3cd851641dceeebd67813eb2

SHA1
8a57f4750c4bc0fe9f7e81a40cb9aa8345024c32

SHA256
1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276

SHA512
ee310207d3561f5bec513606cc543d5861745b09323952d4c1a10169a74e9967f17779298a79059d869b22aba655925acb36def827cd82b6ebb899921b94be65

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe

Filesize
1.9MB

MD5
981c378f3cd851641dceeebd67813eb2

SHA1
8a57f4750c4bc0fe9f7e81a40cb9aa8345024c32

SHA256
1484955ff8374ea3faaab775c666cfd51c7cc827361d8272ddc5041c9b04b276

SHA512
ee310207d3561f5bec513606cc543d5861745b09323952d4c1a10169a74e9967f17779298a79059d869b22aba655925acb36def827cd82b6ebb899921b94be65

Download Submit
memory/240-75-0x000000000040242D-mapping.dmp

Download
memory/240-78-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-83-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-66-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-70-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-69-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-68-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/240-74-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/584-81-0x0000000000000000-mapping.dmp

Download
memory/584-85-0x0000000001130000-0x000000000131C000-memory.dmp

Filesize
1.9MB

Download
memory/604-92-0x0000000000000000-mapping.dmp

Download
memory/612-62-0x0000000000000000-mapping.dmp

Download
memory/652-91-0x0000000000000000-mapping.dmp

Download
memory/1280-60-0x0000000000000000-mapping.dmp

Download
memory/1284-57-0x0000000000000000-mapping.dmp

Download
memory/1312-58-0x0000000000000000-mapping.dmp

Download
memory/1552-54-0x0000000000AB0000-0x0000000000C9C000-memory.dmp

Filesize
1.9MB

Download
memory/1552-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1552-56-0x0000000000380000-0x00000000003CA000-memory.dmp

Filesize
296KB

Download
memory/1744-61-0x0000000000000000-mapping.dmp

Download
memory/1748-59-0x0000000000000000-mapping.dmp

Download
memory/1912-90-0x0000000000000000-mapping.dmp

Download
memory/1968-87-0x0000000000000000-mapping.dmp

Download
memory/1988-89-0x0000000000000000-mapping.dmp

Download
memory/2004-88-0x0000000000000000-mapping.dmp

Download
memory/2008-106-0x000000000040242D-mapping.dmp

Download
memory/2008-110-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2008-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads