netwire | 46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

General

Target

46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
Size

99KB
MD5

68bb2bc04c3e1e1c2d88aa6f73285bb0
SHA1

dc00c4fb8e14e11395935b215c86c88e3e72e0eb
SHA256

46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107
SHA512

f610028ac9d39912d62e8dc8e26f9bbe13f061066561999cb40e0b61362bfc249f35829dacb8d4cb12b1622ed729a4afbc7f73f2595d76da65f4e65807c5a276
SSDEEP

3072:elwT11JOsyobBuL7OdhR5rgGuXMQ8oWfz16xK:EwxdbBuLSdlwWoWh6xK

Score

10^/10

netwire botnet evasion persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1252-85-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1252-87-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1252-88-0x00000000004021DA-mapping.dmp	netwire
behavioral1/memory/1252-92-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1252-94-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

pid process

1252 46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1592 attrib.exe
Loads dropped DLL 1 IoCs

Processes:

46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

pid process

1884 46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

pid	process
1252	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

pid	process
1592	attrib.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exeREG.exeREG.exeREG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

description	pid	process	target process
PID 1884 set thread context of 1252	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
684	ping.exe
668	ping.exe
1080	ping.exe
1244	ping.exe
1584	ping.exe
1212	ping.exe
432	ping.exe
568	ping.exe
1568	ping.exe
1164	ping.exe
1988	ping.exe
1668	ping.exe
612	ping.exe
1932	ping.exe
548	ping.exe
972	ping.exe
564	ping.exe
1784	ping.exe
764	ping.exe
1616	ping.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

pid	process
1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

description pid process

Token: SeDebugPrivilege 1884 46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

description	pid	process
Token: SeDebugPrivilege	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe

description	pid	process	target process
PID 1884 wrote to memory of 1784	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1784	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1784	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1784	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1988	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1988	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1988	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1988	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 684	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 684	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 684	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 684	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 668	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 668	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 668	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 668	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 432	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 432	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 432	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 432	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 764	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 764	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 764	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 764	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 568	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 568	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 568	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 568	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1568	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1568	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1568	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1568	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1668	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1668	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1668	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1668	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1080	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1080	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1080	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1080	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1592	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	attrib.exe
PID 1884 wrote to memory of 1592	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	attrib.exe
PID 1884 wrote to memory of 1592	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	attrib.exe
PID 1884 wrote to memory of 1592	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	attrib.exe
PID 1884 wrote to memory of 1588	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	REG.exe
PID 1884 wrote to memory of 1588	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	REG.exe
PID 1884 wrote to memory of 1588	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	REG.exe
PID 1884 wrote to memory of 1588	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	REG.exe
PID 1884 wrote to memory of 1616	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1616	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1616	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1616	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1244	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1244	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1244	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1244	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1584	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1584	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1584	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 1584	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 612	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 612	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 612	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe
PID 1884 wrote to memory of 612	1884	46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe	ping.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1592 attrib.exe

pid	process
1592	attrib.exe

C:\Users\Admin\AppData\Local\Temp\46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
"C:\Users\Admin\AppData\Local\Temp\46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1784

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1988

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:684

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:668

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:432

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:764

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:568

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1568

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1668

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1080

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1592

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:1588

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1616

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1244

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1584

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:612

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1164

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1932

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:548

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:972

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1212

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:564

C:\Users\Admin\AppData\Local\Temp\46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
"C:\Users\Admin\AppData\Local\Temp\46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe"
2⤵
- Executes dropped EXE
PID:1252

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:912

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:776

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
Filesize
99KB

MD5
68bb2bc04c3e1e1c2d88aa6f73285bb0

SHA1
dc00c4fb8e14e11395935b215c86c88e3e72e0eb

SHA256
46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

SHA512
f610028ac9d39912d62e8dc8e26f9bbe13f061066561999cb40e0b61362bfc249f35829dacb8d4cb12b1622ed729a4afbc7f73f2595d76da65f4e65807c5a276

Download Submit
\Users\Admin\AppData\Local\Temp\46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107.exe
Filesize
99KB

MD5
68bb2bc04c3e1e1c2d88aa6f73285bb0

SHA1
dc00c4fb8e14e11395935b215c86c88e3e72e0eb

SHA256
46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

SHA512
f610028ac9d39912d62e8dc8e26f9bbe13f061066561999cb40e0b61362bfc249f35829dacb8d4cb12b1622ed729a4afbc7f73f2595d76da65f4e65807c5a276

Download Submit
memory/432-61-0x0000000000000000-mapping.dmp

Download
memory/548-75-0x0000000000000000-mapping.dmp

Download
memory/564-78-0x0000000000000000-mapping.dmp

Download
memory/568-63-0x0000000000000000-mapping.dmp

Download
memory/612-72-0x0000000000000000-mapping.dmp

Download
memory/668-60-0x0000000000000000-mapping.dmp

Download
memory/684-58-0x0000000000000000-mapping.dmp

Download
memory/764-62-0x0000000000000000-mapping.dmp

Download
memory/776-95-0x0000000000000000-mapping.dmp

Download
memory/912-93-0x0000000000000000-mapping.dmp

Download
memory/972-76-0x0000000000000000-mapping.dmp

Download
memory/1080-66-0x0000000000000000-mapping.dmp

Download
memory/1164-73-0x0000000000000000-mapping.dmp

Download
memory/1212-77-0x0000000000000000-mapping.dmp

Download
memory/1244-70-0x0000000000000000-mapping.dmp

Download
memory/1252-83-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1252-85-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1252-94-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1252-92-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1252-88-0x00000000004021DA-mapping.dmp

Download
memory/1252-87-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1252-80-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1252-81-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1568-64-0x0000000000000000-mapping.dmp

Download
memory/1584-71-0x0000000000000000-mapping.dmp

Download
memory/1588-68-0x0000000000000000-mapping.dmp

Download
memory/1592-67-0x0000000000000000-mapping.dmp

Download
memory/1616-69-0x0000000000000000-mapping.dmp

Download
memory/1668-65-0x0000000000000000-mapping.dmp

Download
memory/1708-96-0x0000000000000000-mapping.dmp

Download
memory/1784-56-0x0000000000000000-mapping.dmp

Download
memory/1884-55-0x0000000074830000-0x0000000074DDB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1884-59-0x0000000074830000-0x0000000074DDB000-memory.dmp

Filesize
5.7MB

Download
memory/1932-74-0x0000000000000000-mapping.dmp

Download
memory/1988-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads