Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-07-2022 02:56
Static task
static1
Behavioral task
behavioral1
Sample
DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe
Resource
win10v2004-20220414-en
General
-
Target
DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe
-
Size
600KB
-
MD5
b695909a4b4b1aba822856cf9b5c3654
-
SHA1
2700da2718fc48ce83cd00bcb63a8c9673307e1a
-
SHA256
df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0
-
SHA512
f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3
Malware Config
Signatures
-
NetWire RAT payload 5 IoCs
resource yara_rule behavioral2/memory/3344-138-0x0000000000400000-0x0000000000497000-memory.dmp netwire behavioral2/memory/3344-139-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral2/memory/3344-151-0x0000000000400000-0x0000000000497000-memory.dmp netwire behavioral2/memory/4376-169-0x0000000000400000-0x0000000000497000-memory.dmp netwire behavioral2/memory/4376-172-0x0000000000400000-0x0000000000497000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
pid Process 2856 Host.exe 4376 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2P8QKR84-PM04-00CF-8U6P-61AD5237EI1Q} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2P8QKR84-PM04-00CF-8U6P-61AD5237EI1Q}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 3768 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 3344 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 3344 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 2856 Host.exe 4376 Host.exe 4376 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3768 set thread context of 3344 3768 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 84 PID 2856 set thread context of 4376 2856 Host.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3768 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 2856 Host.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3768 wrote to memory of 3344 3768 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 84 PID 3768 wrote to memory of 3344 3768 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 84 PID 3768 wrote to memory of 3344 3768 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 84 PID 3344 wrote to memory of 2856 3344 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 89 PID 3344 wrote to memory of 2856 3344 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 89 PID 3344 wrote to memory of 2856 3344 DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe 89 PID 2856 wrote to memory of 4376 2856 Host.exe 90 PID 2856 wrote to memory of 4376 2856 Host.exe 90 PID 2856 wrote to memory of 4376 2856 Host.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe"C:\Users\Admin\AppData\Local\Temp\DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe"C:\Users\Admin\AppData\Local\Temp\DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe"2⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4376
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600KB
MD5b695909a4b4b1aba822856cf9b5c3654
SHA12700da2718fc48ce83cd00bcb63a8c9673307e1a
SHA256df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0
SHA512f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3
-
Filesize
600KB
MD5b695909a4b4b1aba822856cf9b5c3654
SHA12700da2718fc48ce83cd00bcb63a8c9673307e1a
SHA256df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0
SHA512f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3
-
Filesize
600KB
MD5b695909a4b4b1aba822856cf9b5c3654
SHA12700da2718fc48ce83cd00bcb63a8c9673307e1a
SHA256df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0
SHA512f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3