Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 15:47
Static task
static1
Behavioral task
behavioral1
Sample
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe
Resource
win10v2004-20220812-en
General
-
Target
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe
-
Size
648KB
-
MD5
d6c1a5836df0a1284057bbc9ca36c81b
-
SHA1
0579b7547ab1cb410a85004c9630c9909de5e22b
-
SHA256
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
-
SHA512
c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
SSDEEP
12288:4LHNif1w20d2fcGpXAJmzznHpFnDb2FTmB98CMaL3KFFNwXYTTTXg0:06w2G2vBqmzQTrzNwqk0
Malware Config
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3544-135-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/3544-137-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/3544-140-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/3544-144-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/3412-157-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
HKRUN.exeHKRUN.exepid process 1268 HKRUN.exe 3412 HKRUN.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
HKRUN.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KCU0IT3O-S203-3AK5-A012-E75586QE8077} HKRUN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KCU0IT3O-S203-3AK5-A012-E75586QE8077}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\HKRUN.exe\"" HKRUN.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
HKRUN.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ProLogs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\HKRUN.exe" HKRUN.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ HKRUN.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exeHKRUN.exedescription pid process target process PID 4020 set thread context of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 1268 set thread context of 3412 1268 HKRUN.exe HKRUN.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exeHKRUN.exedescription pid process target process PID 4020 wrote to memory of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 4020 wrote to memory of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 4020 wrote to memory of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 4020 wrote to memory of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 4020 wrote to memory of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 4020 wrote to memory of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 4020 wrote to memory of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 4020 wrote to memory of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 4020 wrote to memory of 3544 4020 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe PID 3544 wrote to memory of 1268 3544 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe HKRUN.exe PID 3544 wrote to memory of 1268 3544 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe HKRUN.exe PID 3544 wrote to memory of 1268 3544 39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe HKRUN.exe PID 1268 wrote to memory of 3412 1268 HKRUN.exe HKRUN.exe PID 1268 wrote to memory of 3412 1268 HKRUN.exe HKRUN.exe PID 1268 wrote to memory of 3412 1268 HKRUN.exe HKRUN.exe PID 1268 wrote to memory of 3412 1268 HKRUN.exe HKRUN.exe PID 1268 wrote to memory of 3412 1268 HKRUN.exe HKRUN.exe PID 1268 wrote to memory of 3412 1268 HKRUN.exe HKRUN.exe PID 1268 wrote to memory of 3412 1268 HKRUN.exe HKRUN.exe PID 1268 wrote to memory of 3412 1268 HKRUN.exe HKRUN.exe PID 1268 wrote to memory of 3412 1268 HKRUN.exe HKRUN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exeFilesize
648KB
MD5d6c1a5836df0a1284057bbc9ca36c81b
SHA10579b7547ab1cb410a85004c9630c9909de5e22b
SHA25639cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
SHA512c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exeFilesize
648KB
MD5d6c1a5836df0a1284057bbc9ca36c81b
SHA10579b7547ab1cb410a85004c9630c9909de5e22b
SHA25639cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
SHA512c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exeFilesize
648KB
MD5d6c1a5836df0a1284057bbc9ca36c81b
SHA10579b7547ab1cb410a85004c9630c9909de5e22b
SHA25639cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7
SHA512c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d
-
memory/1268-152-0x0000000075340000-0x00000000758F1000-memory.dmpFilesize
5.7MB
-
memory/1268-142-0x0000000000000000-mapping.dmp
-
memory/1268-156-0x0000000075340000-0x00000000758F1000-memory.dmpFilesize
5.7MB
-
memory/3412-146-0x0000000000000000-mapping.dmp
-
memory/3412-157-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3544-137-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3544-140-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3544-135-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3544-144-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3544-134-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3544-133-0x0000000000000000-mapping.dmp
-
memory/4020-141-0x0000000075340000-0x00000000758F1000-memory.dmpFilesize
5.7MB
-
memory/4020-132-0x0000000075340000-0x00000000758F1000-memory.dmpFilesize
5.7MB