Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 15:47
Static task
static1
Behavioral task
behavioral1
Sample
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe
Resource
win10v2004-20220812-en
General
-
Target
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe
-
Size
648KB
-
MD5
d6c1a5836df0a1284057bbc9ca36c81b
-
SHA1
0579b7547ab1cb410a85004c9630c9909de5e22b
-
SHA256
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
-
SHA512
c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
SSDEEP
12288:4LHNif1w20d2fcGpXAJmzznHpFnDb2FTmB98CMaL3KFFNwXYTTTXg0:06w2G2vBqmzQTrzNwqk0
Malware Config
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/900-61-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/900-65-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/900-67-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/900-70-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/900-74-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1924-91-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/1924-97-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
HKRUN.exeHKRUN.exepid process 2040 HKRUN.exe 1924 HKRUN.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
HKRUN.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{KCU0IT3O-S203-3AK5-A012-E75586QE8077} HKRUN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{KCU0IT3O-S203-3AK5-A012-E75586QE8077}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\HKRUN.exe\"" HKRUN.exe -
Loads dropped DLL 2 IoCs
Processes:
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exepid process 900 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 900 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
HKRUN.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ HKRUN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ProLogs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\HKRUN.exe" HKRUN.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exeHKRUN.exedescription pid process target process PID 1088 set thread context of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 2040 set thread context of 1924 2040 HKRUN.exe HKRUN.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exeHKRUN.exedescription pid process target process PID 1088 wrote to memory of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 1088 wrote to memory of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 1088 wrote to memory of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 1088 wrote to memory of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 1088 wrote to memory of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 1088 wrote to memory of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 1088 wrote to memory of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 1088 wrote to memory of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 1088 wrote to memory of 900 1088 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 900 wrote to memory of 2040 900 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe HKRUN.exe PID 900 wrote to memory of 2040 900 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe HKRUN.exe PID 900 wrote to memory of 2040 900 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe HKRUN.exe PID 900 wrote to memory of 2040 900 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe HKRUN.exe PID 2040 wrote to memory of 1924 2040 HKRUN.exe HKRUN.exe PID 2040 wrote to memory of 1924 2040 HKRUN.exe HKRUN.exe PID 2040 wrote to memory of 1924 2040 HKRUN.exe HKRUN.exe PID 2040 wrote to memory of 1924 2040 HKRUN.exe HKRUN.exe PID 2040 wrote to memory of 1924 2040 HKRUN.exe HKRUN.exe PID 2040 wrote to memory of 1924 2040 HKRUN.exe HKRUN.exe PID 2040 wrote to memory of 1924 2040 HKRUN.exe HKRUN.exe PID 2040 wrote to memory of 1924 2040 HKRUN.exe HKRUN.exe PID 2040 wrote to memory of 1924 2040 HKRUN.exe HKRUN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1924
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exeFilesize
648KB
MD5d6c1a5836df0a1284057bbc9ca36c81b
SHA10579b7547ab1cb410a85004c9630c9909de5e22b
SHA25639cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
SHA512c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exeFilesize
648KB
MD5d6c1a5836df0a1284057bbc9ca36c81b
SHA10579b7547ab1cb410a85004c9630c9909de5e22b
SHA25639cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
SHA512c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exeFilesize
648KB
MD5d6c1a5836df0a1284057bbc9ca36c81b
SHA10579b7547ab1cb410a85004c9630c9909de5e22b
SHA25639cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
SHA512c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exeFilesize
648KB
MD5d6c1a5836df0a1284057bbc9ca36c81b
SHA10579b7547ab1cb410a85004c9630c9909de5e22b
SHA25639cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
SHA512c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exeFilesize
648KB
MD5d6c1a5836df0a1284057bbc9ca36c81b
SHA10579b7547ab1cb410a85004c9630c9909de5e22b
SHA25639cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
SHA512c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
memory/900-61-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-56-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-70-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-65-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-67-0x00000000004021DA-mapping.dmp
-
memory/900-58-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-55-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/900-74-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1088-54-0x0000000075241000-0x0000000075243000-memory.dmpFilesize
8KB
-
memory/1088-75-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1924-91-0x00000000004021DA-mapping.dmp
-
memory/1924-97-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2040-73-0x0000000000000000-mapping.dmp
-
memory/2040-94-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB