Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 06:34
Static task
static1
Behavioral task
behavioral1
Sample
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe
Resource
win10v2004-20220722-en
General
-
Target
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe
-
Size
664KB
-
MD5
96d9b8339df538ec53818d2d2a6542f5
-
SHA1
0afa566cf2b68389b2026928a6184c76acd0cc8a
-
SHA256
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
-
SHA512
fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
Malware Config
Extracted
netwire
79.134.225.120:8765
-
activex_autorun
true
-
activex_key
{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
true
-
startup_name
win01
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2092-140-0x0000000000400000-0x00000000004A7000-memory.dmp netwire behavioral2/memory/2092-141-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1396 Host.exe 3796 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7XOS4W0K-H4LE-56X7-UJ07-L110BJ4GFYE8}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win01 = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exee8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exeHost.exeHost.exepid process 2016 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe 2092 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe 2092 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe 1396 Host.exe 3796 Host.exe 3796 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exeHost.exedescription pid process target process PID 2016 set thread context of 2092 2016 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe PID 1396 set thread context of 3796 1396 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exeHost.exepid process 2016 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe 1396 Host.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exee8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exeHost.exedescription pid process target process PID 2016 wrote to memory of 2092 2016 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe PID 2016 wrote to memory of 2092 2016 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe PID 2016 wrote to memory of 2092 2016 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe PID 2092 wrote to memory of 1396 2092 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe Host.exe PID 2092 wrote to memory of 1396 2092 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe Host.exe PID 2092 wrote to memory of 1396 2092 e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe Host.exe PID 1396 wrote to memory of 3796 1396 Host.exe Host.exe PID 1396 wrote to memory of 3796 1396 Host.exe Host.exe PID 1396 wrote to memory of 3796 1396 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe"C:\Users\Admin\AppData\Local\Temp\e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe"C:\Users\Admin\AppData\Local\Temp\e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
664KB
MD596d9b8339df538ec53818d2d2a6542f5
SHA10afa566cf2b68389b2026928a6184c76acd0cc8a
SHA256e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
SHA512fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
664KB
MD596d9b8339df538ec53818d2d2a6542f5
SHA10afa566cf2b68389b2026928a6184c76acd0cc8a
SHA256e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
SHA512fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
664KB
MD596d9b8339df538ec53818d2d2a6542f5
SHA10afa566cf2b68389b2026928a6184c76acd0cc8a
SHA256e8fdf11abbe99931a8bdd989a3dd59b0ca0bd3cd9eaf8868c973edfa1ff47aa8
SHA512fb8c31ee839bf2b9c1184e0283a757598a072e04f830720a8afc2445dc6319dbec360642642793d87d71b9f64d1554905e33d4a5511f600b96098ac24ced9d37
-
memory/1396-159-0x0000000002A80000-0x0000000002A8E000-memory.dmpFilesize
56KB
-
memory/1396-160-0x0000000077030000-0x00000000771D3000-memory.dmpFilesize
1.6MB
-
memory/1396-147-0x0000000000000000-mapping.dmp
-
memory/1396-155-0x00007FFB28990000-0x00007FFB28B85000-memory.dmpFilesize
2.0MB
-
memory/1396-156-0x0000000077030000-0x00000000771D3000-memory.dmpFilesize
1.6MB
-
memory/2016-138-0x0000000002270000-0x000000000227E000-memory.dmpFilesize
56KB
-
memory/2016-139-0x0000000077030000-0x00000000771D3000-memory.dmpFilesize
1.6MB
-
memory/2016-134-0x0000000002270000-0x000000000227E000-memory.dmpFilesize
56KB
-
memory/2016-136-0x0000000077030000-0x00000000771D3000-memory.dmpFilesize
1.6MB
-
memory/2016-135-0x00007FFB28990000-0x00007FFB28B85000-memory.dmpFilesize
2.0MB
-
memory/2092-140-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/2092-154-0x0000000077030000-0x00000000771D3000-memory.dmpFilesize
1.6MB
-
memory/2092-152-0x00007FFB28990000-0x00007FFB28B85000-memory.dmpFilesize
2.0MB
-
memory/2092-150-0x00000000005D0000-0x00000000005DE000-memory.dmpFilesize
56KB
-
memory/2092-141-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2092-137-0x0000000000000000-mapping.dmp
-
memory/3796-157-0x0000000000000000-mapping.dmp
-
memory/3796-168-0x00007FFB28990000-0x00007FFB28B85000-memory.dmpFilesize
2.0MB
-
memory/3796-169-0x0000000077030000-0x00000000771D3000-memory.dmpFilesize
1.6MB
-
memory/3796-170-0x00000000004F0000-0x00000000004FE000-memory.dmpFilesize
56KB
-
memory/3796-171-0x0000000077030000-0x00000000771D3000-memory.dmpFilesize
1.6MB