Analysis
-
max time kernel
112s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 06:34
Static task
static1
Behavioral task
behavioral1
Sample
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe
Resource
win10v2004-20220722-en
General
-
Target
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe
-
Size
664KB
-
MD5
96d9b8339df538ec53818d2d2a6542f5
-
SHA1
0afa566cf2b68389b2026928a6184c76acd0cc8a
-
SHA256
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
-
SHA512
fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
Malware Config
Extracted
netwire
79.134.225.120:8765
-
activex_autorun
true
-
activex_key
{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
true
-
startup_name
win01
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1500-66-0x0000000000400000-0x00000000004A7000-memory.dmp netwire behavioral1/memory/1500-67-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/288-92-0x0000000000400000-0x00000000004A7000-memory.dmp netwire behavioral1/memory/288-93-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1596 Host.exe 288 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Loads dropped DLL 2 IoCs
Processes:
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exepid process 1500 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe 1500 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\win01 = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exee8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exeHost.exeHost.exepid process 1644 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe 1500 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe 1500 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe 1596 Host.exe 288 Host.exe 288 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exeHost.exedescription pid process target process PID 1644 set thread context of 1500 1644 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe PID 1596 set thread context of 288 1596 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exeHost.exepid process 1644 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe 1596 Host.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exee8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exeHost.exedescription pid process target process PID 1644 wrote to memory of 1500 1644 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe PID 1644 wrote to memory of 1500 1644 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe PID 1644 wrote to memory of 1500 1644 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe PID 1644 wrote to memory of 1500 1644 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe PID 1500 wrote to memory of 1596 1500 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe Host.exe PID 1500 wrote to memory of 1596 1500 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe Host.exe PID 1500 wrote to memory of 1596 1500 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe Host.exe PID 1500 wrote to memory of 1596 1500 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe Host.exe PID 1596 wrote to memory of 288 1596 Host.exe Host.exe PID 1596 wrote to memory of 288 1596 Host.exe Host.exe PID 1596 wrote to memory of 288 1596 Host.exe Host.exe PID 1596 wrote to memory of 288 1596 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe"C:\Users\Admin\AppData\Local\Temp\e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe"C:\Users\Admin\AppData\Local\Temp\e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
664KB
MD596d9b8339df538ec53818d2d2a6542f5
SHA10afa566cf2b68389b2026928a6184c76acd0cc8a
SHA256e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
SHA512fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
664KB
MD596d9b8339df538ec53818d2d2a6542f5
SHA10afa566cf2b68389b2026928a6184c76acd0cc8a
SHA256e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
SHA512fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
664KB
MD596d9b8339df538ec53818d2d2a6542f5
SHA10afa566cf2b68389b2026928a6184c76acd0cc8a
SHA256e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
SHA512fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
664KB
MD596d9b8339df538ec53818d2d2a6542f5
SHA10afa566cf2b68389b2026928a6184c76acd0cc8a
SHA256e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
SHA512fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
664KB
MD596d9b8339df538ec53818d2d2a6542f5
SHA10afa566cf2b68389b2026928a6184c76acd0cc8a
SHA256e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
SHA512fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
-
memory/288-86-0x0000000000420B04-mapping.dmp
-
memory/288-99-0x0000000077990000-0x0000000077B39000-memory.dmpFilesize
1.7MB
-
memory/288-93-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/288-92-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/1500-81-0x0000000077B70000-0x0000000077CF0000-memory.dmpFilesize
1.5MB
-
memory/1500-66-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/1500-67-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1500-61-0x0000000000420B04-mapping.dmp
-
memory/1500-76-0x0000000000220000-0x000000000022E000-memory.dmpFilesize
56KB
-
memory/1500-79-0x0000000077990000-0x0000000077B39000-memory.dmpFilesize
1.7MB
-
memory/1596-75-0x0000000000000000-mapping.dmp
-
memory/1596-84-0x0000000077990000-0x0000000077B39000-memory.dmpFilesize
1.7MB
-
memory/1596-88-0x0000000000270000-0x000000000027E000-memory.dmpFilesize
56KB
-
memory/1596-89-0x0000000077B70000-0x0000000077CF0000-memory.dmpFilesize
1.5MB
-
memory/1644-58-0x0000000077990000-0x0000000077B39000-memory.dmpFilesize
1.7MB
-
memory/1644-56-0x00000000003D0000-0x00000000003DE000-memory.dmpFilesize
56KB
-
memory/1644-57-0x00000000763E1000-0x00000000763E3000-memory.dmpFilesize
8KB
-
memory/1644-59-0x0000000077B70000-0x0000000077CF0000-memory.dmpFilesize
1.5MB
-
memory/1644-63-0x0000000077B70000-0x0000000077CF0000-memory.dmpFilesize
1.5MB
-
memory/1644-62-0x00000000003D0000-0x00000000003DE000-memory.dmpFilesize
56KB