netwire | 13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c

General

Target

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
Size

178KB
MD5

0b62db064492dbaded5dd07fc9a508d0
SHA1

c7a8c3cb25aa63fc304cca8f30c780a0427e8e8b
SHA256

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c
SHA512

e222eabbd621f263b6745f1498dc011d75bfd7686979fa5477b031c6546aa9df22d6e0ba93ba02de43858812e1bcf9b3d4d63f6e77e25eb4b01a2d8a949e843a
SSDEEP

3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwc:I7VzxYnWI6agAalr4UrPp8WStPQu285

Score

10^/10

netwire botnet evasion persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4124-157-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4124-160-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4124-162-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 1 IoCs

Processes:

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

pid process

4124 13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2024 attrib.exe

pid	process
4124	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

pid	process
2024	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

description	pid	process	target process
PID 4368 set thread context of 4124	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
4564	ping.exe
3308	ping.exe
4584	ping.exe
720	ping.exe
4804	ping.exe
552	ping.exe
2336	ping.exe
2672	ping.exe
4184	ping.exe
1440	ping.exe
3344	ping.exe
1300	ping.exe
1228	ping.exe
2384	ping.exe
1308	ping.exe
2924	ping.exe
2840	ping.exe
4796	ping.exe
3104	ping.exe
5032	ping.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

pid	process
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

description pid process

Token: SeDebugPrivilege 4368 13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

description	pid	process
Token: SeDebugPrivilege	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe

description	pid	process	target process
PID 4368 wrote to memory of 2840	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2840	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2840	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4584	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4584	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4584	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1440	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1440	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1440	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4796	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4796	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4796	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 720	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 720	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 720	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4804	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4804	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4804	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 552	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 552	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 552	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 3344	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 3344	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 3344	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1308	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1308	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1308	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2336	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2336	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2336	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2024	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	attrib.exe
PID 4368 wrote to memory of 2024	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	attrib.exe
PID 4368 wrote to memory of 2024	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	attrib.exe
PID 4368 wrote to memory of 2132	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	REG.exe
PID 4368 wrote to memory of 2132	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	REG.exe
PID 4368 wrote to memory of 2132	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	REG.exe
PID 4368 wrote to memory of 1300	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1300	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1300	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1228	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1228	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 1228	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4564	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4564	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4564	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2384	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2384	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2384	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2924	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2924	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2924	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2672	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2672	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 2672	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 3308	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 3308	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 3308	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4184	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4184	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 4184	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 3104	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 3104	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 3104	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe
PID 4368 wrote to memory of 5032	4368	13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe	ping.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2024 attrib.exe

pid	process
2024	attrib.exe

C:\Users\Admin\AppData\Local\Temp\13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
"C:\Users\Admin\AppData\Local\Temp\13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:2840

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:4584

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1440

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:4796

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:720

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:4804

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:552

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:3344

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1308

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:2336

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2024

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:2132

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1300

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:1228

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:4564

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:2384

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:2924

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:2672

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:3308

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:4184

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:3104

C:\Windows\SysWOW64\ping.exe
C:\Windows\System32\ping.exe google.com
2⤵
- Runs ping.exe
PID:5032

C:\Users\Admin\AppData\Local\Temp\13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
"C:\Users\Admin\AppData\Local\Temp\13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe"
2⤵
- Executes dropped EXE
PID:4124

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:2884

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:4352

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:5016

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:4396

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:1720

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:4848

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:4068

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:4048

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:1480

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:4940

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:1056

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:4568

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:3696

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:1452

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:3900

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:1836

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
2⤵
- Adds Run key to start application
PID:4484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c.exe
Filesize
178KB

MD5
0b62db064492dbaded5dd07fc9a508d0

SHA1
c7a8c3cb25aa63fc304cca8f30c780a0427e8e8b

SHA256
13a58ff5a236a3986c66784f0ea4bc2b9dba906cbaa752f1d8df9d68e46bfc2c

SHA512
e222eabbd621f263b6745f1498dc011d75bfd7686979fa5477b031c6546aa9df22d6e0ba93ba02de43858812e1bcf9b3d4d63f6e77e25eb4b01a2d8a949e843a

Download Submit
memory/552-140-0x0000000000000000-mapping.dmp

Download
memory/720-138-0x0000000000000000-mapping.dmp

Download
memory/1056-172-0x0000000000000000-mapping.dmp

Download
memory/1228-147-0x0000000000000000-mapping.dmp

Download
memory/1300-146-0x0000000000000000-mapping.dmp

Download
memory/1308-142-0x0000000000000000-mapping.dmp

Download
memory/1440-135-0x0000000000000000-mapping.dmp

Download
memory/1452-175-0x0000000000000000-mapping.dmp

Download
memory/1480-170-0x0000000000000000-mapping.dmp

Download
memory/1720-166-0x0000000000000000-mapping.dmp

Download
memory/1836-177-0x0000000000000000-mapping.dmp

Download
memory/2024-144-0x0000000000000000-mapping.dmp

Download
memory/2132-145-0x0000000000000000-mapping.dmp

Download
memory/2336-143-0x0000000000000000-mapping.dmp

Download
memory/2384-149-0x0000000000000000-mapping.dmp

Download
memory/2672-151-0x0000000000000000-mapping.dmp

Download
memory/2840-132-0x0000000000000000-mapping.dmp

Download
memory/2884-161-0x0000000000000000-mapping.dmp

Download
memory/2924-150-0x0000000000000000-mapping.dmp

Download
memory/3104-154-0x0000000000000000-mapping.dmp

Download
memory/3308-152-0x0000000000000000-mapping.dmp

Download
memory/3344-141-0x0000000000000000-mapping.dmp

Download
memory/3696-174-0x0000000000000000-mapping.dmp

Download
memory/3900-176-0x0000000000000000-mapping.dmp

Download
memory/4048-169-0x0000000000000000-mapping.dmp

Download
memory/4068-168-0x0000000000000000-mapping.dmp

Download
memory/4124-160-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4124-156-0x0000000000000000-mapping.dmp

Download
memory/4124-162-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4124-157-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4184-153-0x0000000000000000-mapping.dmp

Download
memory/4352-163-0x0000000000000000-mapping.dmp

Download
memory/4368-133-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/4368-137-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/4396-165-0x0000000000000000-mapping.dmp

Download
memory/4484-178-0x0000000000000000-mapping.dmp

Download
memory/4564-148-0x0000000000000000-mapping.dmp

Download
memory/4568-173-0x0000000000000000-mapping.dmp

Download
memory/4584-134-0x0000000000000000-mapping.dmp

Download
memory/4796-136-0x0000000000000000-mapping.dmp

Download
memory/4804-139-0x0000000000000000-mapping.dmp

Download
memory/4848-167-0x0000000000000000-mapping.dmp

Download
memory/4940-171-0x0000000000000000-mapping.dmp

Download
memory/5016-164-0x0000000000000000-mapping.dmp

Download
memory/5032-155-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads