Analysis
-
max time kernel
134s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2022 18:04
Static task
static1
Behavioral task
behavioral1
Sample
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe
Resource
win10v2004-20220812-en
General
-
Target
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe
-
Size
396KB
-
MD5
6c33cc232ababa439e295a455f3980a0
-
SHA1
774365e9521f8087145820b49814d28f37e5c65e
-
SHA256
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
-
SHA512
48c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
SSDEEP
3072:LBB+77tPHkDLQ2AhPlG/1WBZf7qF/Z2iYmsdxDxUxt6mDLoGrww9JGbtENmszvZ+:Lf+7ODLQ2GEWBZE22lnNlRRP
Malware Config
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2024-134-0x0000000000000000-mapping.dmp netwire behavioral2/memory/2024-135-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/2024-138-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/2024-142-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/1820-145-0x0000000000000000-mapping.dmp netwire behavioral2/memory/1820-150-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 220 Host.exe 1820 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3GYL0VK1-5SB1-4X20-W6B8-PQP7L2B50166} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3GYL0VK1-5SB1-4X20-W6B8-PQP7L2B50166}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exeHost.exedescription pid process target process PID 4264 set thread context of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 220 set thread context of 1820 220 Host.exe Host.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2280 2936 WerFault.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid process 3748 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exeHost.exepid process 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe 220 Host.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exed1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exeHost.exedescription pid process target process PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 4264 wrote to memory of 2024 4264 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe PID 2024 wrote to memory of 220 2024 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe Host.exe PID 2024 wrote to memory of 220 2024 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe Host.exe PID 2024 wrote to memory of 220 2024 d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe PID 220 wrote to memory of 1820 220 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 2936 -ip 29361⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2936 -s 10721⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
396KB
MD56c33cc232ababa439e295a455f3980a0
SHA1774365e9521f8087145820b49814d28f37e5c65e
SHA256d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
SHA51248c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
396KB
MD56c33cc232ababa439e295a455f3980a0
SHA1774365e9521f8087145820b49814d28f37e5c65e
SHA256d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
SHA51248c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
396KB
MD56c33cc232ababa439e295a455f3980a0
SHA1774365e9521f8087145820b49814d28f37e5c65e
SHA256d1be6471a46b5d2cae582b6bad0646cc3b59c85df440363a77f2bb41ab553e82
SHA51248c9aa276dc7532766865b3159f5d2c9b9f8cb942060ddc1d311eff8a5d3e8a52fa0ae353975a6ea19625c5e7f9a285602784b3ae8f0b5c50f9bdda19c4ce347
-
memory/220-139-0x0000000000000000-mapping.dmp
-
memory/1820-145-0x0000000000000000-mapping.dmp
-
memory/1820-150-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2024-134-0x0000000000000000-mapping.dmp
-
memory/2024-135-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2024-138-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2024-142-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4264-136-0x00000000021D0000-0x00000000021D6000-memory.dmpFilesize
24KB