Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-10-2022 18:04
Static task
static1
Behavioral task
behavioral1
Sample
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe
Resource
win10v2004-20220812-en
General
-
Target
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe
-
Size
396KB
-
MD5
6c33cc232ababa439e295a455f3980a0
-
SHA1
774365e9521f8087145820b49814d28f37e5c65e
-
SHA256
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
-
SHA512
48c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
SSDEEP
3072:LBB+77tPHkDLQ2AhPlG/1WBZf7qF/Z2iYmsdxDxUxt6mDLoGrww9JGbtENmszvZ+:Lf+7ODLQ2GEWBZE22lnNlRRP
Malware Config
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-57-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1712-58-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/1712-62-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1712-67-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1064-73-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/1064-78-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 844 Host.exe 1064 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3GYL0VK1-5SB1-4X20-W6B8-PQP7L2B50166} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3GYL0VK1-5SB1-4X20-W6B8-PQP7L2B50166}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Deletes itself 1 IoCs
Processes:
Host.exepid process 1064 Host.exe -
Loads dropped DLL 2 IoCs
Processes:
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exepid process 1712 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe 1712 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exeHost.exedescription pid process target process PID 1708 set thread context of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 844 set thread context of 1064 844 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exeHost.exepid process 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe 844 Host.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exed1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exeHost.exedescription pid process target process PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1708 wrote to memory of 1712 1708 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 1712 wrote to memory of 844 1712 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe Host.exe PID 1712 wrote to memory of 844 1712 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe Host.exe PID 1712 wrote to memory of 844 1712 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe Host.exe PID 1712 wrote to memory of 844 1712 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe PID 844 wrote to memory of 1064 844 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Deletes itself
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
396KB
MD56c33cc232ababa439e295a455f3980a0
SHA1774365e9521f8087145820b49814d28f37e5c65e
SHA256d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
SHA51248c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
396KB
MD56c33cc232ababa439e295a455f3980a0
SHA1774365e9521f8087145820b49814d28f37e5c65e
SHA256d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
SHA51248c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
396KB
MD56c33cc232ababa439e295a455f3980a0
SHA1774365e9521f8087145820b49814d28f37e5c65e
SHA256d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
SHA51248c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
396KB
MD56c33cc232ababa439e295a455f3980a0
SHA1774365e9521f8087145820b49814d28f37e5c65e
SHA256d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
SHA51248c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
396KB
MD56c33cc232ababa439e295a455f3980a0
SHA1774365e9521f8087145820b49814d28f37e5c65e
SHA256d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
SHA51248c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
memory/844-65-0x0000000000000000-mapping.dmp
-
memory/1064-78-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1064-73-0x00000000004021DA-mapping.dmp
-
memory/1708-59-0x0000000000470000-0x0000000000476000-memory.dmpFilesize
24KB
-
memory/1708-56-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/1712-67-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1712-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1712-58-0x00000000004021DA-mapping.dmp
-
memory/1712-57-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB