Analysis
-
max time kernel
150s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-10-2022 21:09
Static task
static1
Behavioral task
behavioral1
Sample
b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe
Resource
win10v2004-20220901-en
General
-
Target
b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe
-
Size
144KB
-
MD5
80d8183a09571de19180f3edcb8cdda0
-
SHA1
cf3e3cd2715b3e39216089994a1f3f84fb9dc5af
-
SHA256
b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c
-
SHA512
15c398c7ace251b6b8341b7b34f117fe2282e8be2c7ba8cca64afce86fbb7ca6c282bbe22324de4069a551a77efb641f069595fd5898263522d3e67d7a749a98
-
SSDEEP
3072:rjTN2glF4hbNHxLjezR2Ttcd66InyLRj9w/BswyZUX:vp2gTEbNHx/WWSd6PnGtU
Malware Config
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1440-62-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1440-66-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1440-68-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/1440-72-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1440-73-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/324-93-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/324-99-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1992 Host.exe 324 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8MC32WT-67BF-H8AA-E3E1-8G41D50SWXQ1} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8MC32WT-67BF-H8AA-E3E1-8G41D50SWXQ1}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Loads dropped DLL 2 IoCs
Processes:
b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exepid process 1440 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe 1440 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exeHost.exedescription pid process target process PID 896 set thread context of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 1992 set thread context of 324 1992 Host.exe Host.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Host.exedescription pid process Token: SeDebugPrivilege 1992 Host.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exeb8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exeHost.exedescription pid process target process PID 896 wrote to memory of 936 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 936 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 936 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 936 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 896 wrote to memory of 1440 896 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe PID 1440 wrote to memory of 1992 1440 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe Host.exe PID 1440 wrote to memory of 1992 1440 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe Host.exe PID 1440 wrote to memory of 1992 1440 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe Host.exe PID 1440 wrote to memory of 1992 1440 b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe Host.exe PID 1992 wrote to memory of 324 1992 Host.exe Host.exe PID 1992 wrote to memory of 324 1992 Host.exe Host.exe PID 1992 wrote to memory of 324 1992 Host.exe Host.exe PID 1992 wrote to memory of 324 1992 Host.exe Host.exe PID 1992 wrote to memory of 324 1992 Host.exe Host.exe PID 1992 wrote to memory of 324 1992 Host.exe Host.exe PID 1992 wrote to memory of 324 1992 Host.exe Host.exe PID 1992 wrote to memory of 324 1992 Host.exe Host.exe PID 1992 wrote to memory of 324 1992 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe"C:\Users\Admin\AppData\Local\Temp\b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe"C:\Users\Admin\AppData\Local\Temp\b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe"C:\Users\Admin\AppData\Local\Temp\b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
144KB
MD580d8183a09571de19180f3edcb8cdda0
SHA1cf3e3cd2715b3e39216089994a1f3f84fb9dc5af
SHA256b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c
SHA51215c398c7ace251b6b8341b7b34f117fe2282e8be2c7ba8cca64afce86fbb7ca6c282bbe22324de4069a551a77efb641f069595fd5898263522d3e67d7a749a98
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
144KB
MD580d8183a09571de19180f3edcb8cdda0
SHA1cf3e3cd2715b3e39216089994a1f3f84fb9dc5af
SHA256b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c
SHA51215c398c7ace251b6b8341b7b34f117fe2282e8be2c7ba8cca64afce86fbb7ca6c282bbe22324de4069a551a77efb641f069595fd5898263522d3e67d7a749a98
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
144KB
MD580d8183a09571de19180f3edcb8cdda0
SHA1cf3e3cd2715b3e39216089994a1f3f84fb9dc5af
SHA256b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c
SHA51215c398c7ace251b6b8341b7b34f117fe2282e8be2c7ba8cca64afce86fbb7ca6c282bbe22324de4069a551a77efb641f069595fd5898263522d3e67d7a749a98
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
144KB
MD580d8183a09571de19180f3edcb8cdda0
SHA1cf3e3cd2715b3e39216089994a1f3f84fb9dc5af
SHA256b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c
SHA51215c398c7ace251b6b8341b7b34f117fe2282e8be2c7ba8cca64afce86fbb7ca6c282bbe22324de4069a551a77efb641f069595fd5898263522d3e67d7a749a98
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
144KB
MD580d8183a09571de19180f3edcb8cdda0
SHA1cf3e3cd2715b3e39216089994a1f3f84fb9dc5af
SHA256b8467c52e65c68adfb32e17767b1e5c43a810dfe70e8cd162b5e78b54c78670c
SHA51215c398c7ace251b6b8341b7b34f117fe2282e8be2c7ba8cca64afce86fbb7ca6c282bbe22324de4069a551a77efb641f069595fd5898263522d3e67d7a749a98
-
memory/324-99-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/324-93-0x00000000004021DA-mapping.dmp
-
memory/896-55-0x0000000074970000-0x0000000074F1B000-memory.dmpFilesize
5.7MB
-
memory/896-54-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/896-70-0x0000000074970000-0x0000000074F1B000-memory.dmpFilesize
5.7MB
-
memory/1440-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1440-73-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1440-72-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1440-68-0x00000000004021DA-mapping.dmp
-
memory/1440-66-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1440-57-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1440-59-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1440-56-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1992-76-0x0000000000000000-mapping.dmp
-
memory/1992-80-0x0000000074900000-0x0000000074EAB000-memory.dmpFilesize
5.7MB
-
memory/1992-96-0x0000000074900000-0x0000000074EAB000-memory.dmpFilesize
5.7MB