Analysis
-
max time kernel
103s -
max time network
112s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 04:15
Static task
static1
Behavioral task
behavioral1
Sample
3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
General
-
Target
3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
-
Size
356KB
-
MD5
e971ab88ed635c928ab36139eecbb6da
-
SHA1
8860910e86517a56547d2d76f7903d5313077e10
-
SHA256
3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56
-
SHA512
78d97c314561cbbd0cc7e42f0bd1560fc46d56ec5c55e8997a271c7cc0d9ccf2240fc7af33912c28c4554b39e9b5b8e44acc18b4359fc796ef92be3068298c5c
-
SSDEEP
6144:oTvspNdntRNxcGhGEi7F875mif7yL3OfytFd8HrI8wAcuL4u+NR94:oTspNtNxcmO7F87vf7J8Fak/uV+NR94
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1016-62-0x0000000000400000-0x0000000001400000-memory.dmp netwire behavioral1/memory/1016-65-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/1016-69-0x0000000000400000-0x0000000001400000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exedescription pid process target process PID 1660 set thread context of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exepid process 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exepid process 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exedescription pid process target process PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe PID 1660 wrote to memory of 1016 1660 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe 3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe"C:\Users\Admin\AppData\Local\Temp\3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exeC:\Users\Admin\AppData\Local\Temp\3a4c244d3ae1e9f9ce45fd2d4551aa484f256aeda3354dc4b42a86403be35b56.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1016-55-0x00000000001B0000-0x00000000002AA000-memory.dmpFilesize
1000KB
-
memory/1016-57-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1016-58-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1016-60-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1016-62-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1016-65-0x00000000004021DA-mapping.dmp
-
memory/1016-64-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1016-69-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1016-70-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1660-54-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB
-
memory/1660-66-0x00000000002F0000-0x00000000002F4000-memory.dmpFilesize
16KB