netwire | 8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
Size

376KB
MD5

459a9784acc3b399353d69f2fa3f8b5b
SHA1

5e5e865827862a57962f8e35b09d9bd13743e468
SHA256

8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb
SHA512

69c67f2f337955a1d7a90e0a497b8063ff1c3aa39bb4df8409be785b5201a6a86f59842b296bfd01e9258f3c3bb254b75ebf77477cdf2f7bb0dfd0c99509a41c
SSDEEP

3072:LMiftEtorupusNhKBCMLxOAHIxc+4ywEQ2qTHah6YwqsXRmp8l3C8xpayOKOH:LlWtM6hKoInIxc+4Z9aQTmuh7va5pH

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4660-146-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral2/memory/3980-156-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral2/memory/3980-158-0x0000000000400000-0x0000000000417000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 4 IoCs

Processes:

Host.exe8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exeHost.exeHost.exe

pid process

2376 Host.exe
4660 8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
3684 Host.exe
3980 Host.exe

pid	process
2376	Host.exe
4660	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
3684	Host.exe
3980	Host.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B16Y3GP-J7FN-N7P5-R4TR-5G2P0556Y2SL}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B16Y3GP-J7FN-N7P5-R4TR-5G2P0556Y2SL}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Host.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe"	Host.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Host.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4012 220 WerFault.exe iexplore.exe

pid	pid_target	process	target process
4012	220	WerFault.exe	iexplore.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exeHost.exe

description	pid	process	target process
PID 4376 set thread context of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4376 set thread context of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 3684 set thread context of 220	3684	Host.exe	iexplore.exe
PID 3684 set thread context of 3980	3684	Host.exe	Host.exe

Drops file in Program Files directory 1 IoCs

Processes:

iexplore.exe

description ioc process

File created C:\Program Files (x86)\Internet Explorer\.Identifier iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\.Identifier	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998924"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000007041acbf4ec4cc9ca4f785e4e4f679f805d66f48d28a1c3075d8b7060bae1afe000000000e80000000020000200000000b298d788319ff7ff454fde08094ea009e928353d0e5161ec3b7e35366fccbdc200000000ce01cd6deedf37abfb82837680da5a44162be5b9f03684aed3ad6ed29df9eae4000000074fce82011f37fbe57557f99e4f46f6a82e9d014e1bf91ada9ec1d34dc895b8f6eb611bcf57045fb2ed15cdd31ce2e6573327a0e02722625022d3e5e0ea17908	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a328508c01d901	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998924"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1302186328"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1302186328"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7926764D-6D7F-11ED-A0EE-7EA98FCFBA26} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1309687484"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376227953"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004539508c01d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998924"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000000134ed4a6efddb1a033c9dcaf93a378ea50e7aeb62af108e17d0d061d073c213000000000e8000000002000020000000d5f1eca6fbcee1fcec344291e77d414abe49d50116b0b64489c15d04f386e5c3200000008c5125ffad7cd4c2d4639ebe59284b9a3c341b61bd3dae2d4bbf24249205be0e40000000894a5ac9eafe9191ad53ebe0c2089b563c7f450bc3b9b9f63fa8b945ac1a2d0bab496f86e10f7573a064a14bbecaae73e1ca6d4327fc9bc64bcecc8830880574	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exeHost.exe

pid	process
4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
3684	Host.exe
3684	Host.exe
3684	Host.exe
3684	Host.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2248 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2248 IEXPLORE.EXE

pid	process
2248	IEXPLORE.EXE

pid	process
2248	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exeIEXPLORE.EXEIEXPLORE.EXEHost.exe

pid	process
4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
4824	IEXPLORE.EXE
4824	IEXPLORE.EXE
3684	Host.exe
3684	Host.exe
4824	IEXPLORE.EXE
4824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.execmd.exenet.exeiexplore.exeHost.exeIEXPLORE.EXE8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exeHost.execmd.exenet.exe

description	pid	process	target process
PID 4376 wrote to memory of 4596	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	cmd.exe
PID 4376 wrote to memory of 4596	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	cmd.exe
PID 4376 wrote to memory of 4596	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	cmd.exe
PID 4376 wrote to memory of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4376 wrote to memory of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4376 wrote to memory of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4376 wrote to memory of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4376 wrote to memory of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4376 wrote to memory of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4376 wrote to memory of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4376 wrote to memory of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4376 wrote to memory of 3404	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	iexplore.exe
PID 4596 wrote to memory of 3508	4596	cmd.exe	net.exe
PID 4596 wrote to memory of 3508	4596	cmd.exe	net.exe
PID 4596 wrote to memory of 3508	4596	cmd.exe	net.exe
PID 3508 wrote to memory of 2264	3508	net.exe	net1.exe
PID 3508 wrote to memory of 2264	3508	net.exe	net1.exe
PID 3508 wrote to memory of 2264	3508	net.exe	net1.exe
PID 3404 wrote to memory of 2376	3404	iexplore.exe	Host.exe
PID 3404 wrote to memory of 2376	3404	iexplore.exe	Host.exe
PID 3404 wrote to memory of 2376	3404	iexplore.exe	Host.exe
PID 2376 wrote to memory of 2248	2376	Host.exe	IEXPLORE.EXE
PID 2376 wrote to memory of 2248	2376	Host.exe	IEXPLORE.EXE
PID 2248 wrote to memory of 4824	2248	IEXPLORE.EXE	IEXPLORE.EXE
PID 2248 wrote to memory of 4824	2248	IEXPLORE.EXE	IEXPLORE.EXE
PID 2248 wrote to memory of 4824	2248	IEXPLORE.EXE	IEXPLORE.EXE
PID 4376 wrote to memory of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 4376 wrote to memory of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 4376 wrote to memory of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 4376 wrote to memory of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 4376 wrote to memory of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 4376 wrote to memory of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 4376 wrote to memory of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 4376 wrote to memory of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 4376 wrote to memory of 4660	4376	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
PID 4660 wrote to memory of 3684	4660	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	Host.exe
PID 4660 wrote to memory of 3684	4660	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	Host.exe
PID 4660 wrote to memory of 3684	4660	8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe	Host.exe
PID 3684 wrote to memory of 4084	3684	Host.exe	cmd.exe
PID 3684 wrote to memory of 4084	3684	Host.exe	cmd.exe
PID 3684 wrote to memory of 4084	3684	Host.exe	cmd.exe
PID 3684 wrote to memory of 220	3684	Host.exe	iexplore.exe
PID 3684 wrote to memory of 220	3684	Host.exe	iexplore.exe
PID 3684 wrote to memory of 220	3684	Host.exe	iexplore.exe
PID 3684 wrote to memory of 220	3684	Host.exe	iexplore.exe
PID 4084 wrote to memory of 2164	4084	cmd.exe	net.exe
PID 4084 wrote to memory of 2164	4084	cmd.exe	net.exe
PID 4084 wrote to memory of 2164	4084	cmd.exe	net.exe
PID 2164 wrote to memory of 3728	2164	net.exe	net1.exe
PID 2164 wrote to memory of 3728	2164	net.exe	net1.exe
PID 2164 wrote to memory of 3728	2164	net.exe	net1.exe
PID 3684 wrote to memory of 3980	3684	Host.exe	Host.exe
PID 3684 wrote to memory of 3980	3684	Host.exe	Host.exe
PID 3684 wrote to memory of 3980	3684	Host.exe	Host.exe
PID 3684 wrote to memory of 3980	3684	Host.exe	Host.exe
PID 3684 wrote to memory of 3980	3684	Host.exe	Host.exe
PID 3684 wrote to memory of 3980	3684	Host.exe	Host.exe
PID 3684 wrote to memory of 3980	3684	Host.exe	Host.exe
PID 3684 wrote to memory of 3980	3684	Host.exe	Host.exe
PID 3684 wrote to memory of 3980	3684	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
"C:\Users\Admin\AppData\Local\Temp\8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376

C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
2⤵
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\SysWOW64\net.exe
net stop MpsSvc
3⤵
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
4⤵
PID:2264

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3404

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m C:\Program Files (x86)\Internet Explorer\iexplore.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -m C:\Program Files (x86)\Internet Explorer\iexplore.exe
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4824

C:\Users\Admin\AppData\Local\Temp\8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
C:\Users\Admin\AppData\Local\Temp\8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4660

C:\Users\Admin\AppData\Roaming\Install\Host.exe
"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m C:\Users\Admin\AppData\Local\Temp\8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
4⤵
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\SysWOW64\net.exe
net stop MpsSvc
5⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
6⤵
PID:3728

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
4⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 84
5⤵
- Program crash
PID:4012

C:\Users\Admin\AppData\Roaming\Install\Host.exe
C:\Users\Admin\AppData\Roaming\Install\Host.exe
4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 220 -ip 220
1⤵
PID:4780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
Filesize
1KB

MD5
fe56e8724f14ce1f3b7aefb4a62b0c16

SHA1
bdac2e002becfc2b8ffca0973540fa2851d21ebd

SHA256
3d06f4d78345d522e29652ada389e858ed290fcf2b3b783b1009f0525d55c7a4

SHA512
a5c18aeb916a3d1c68289c1b54a2e2269834bc8cd0df3702e98a4d0d480d74ff1cb663b184de89938f1d9c357d05e075ad27cd2f4bc09e02cd213c1fffb27950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
33b7e09d1c6e875887fd38ae0a7ee659

SHA1
192864bc83504fafbd87af8c3834b835076c414a

SHA256
f200eaab5663e542461bbae7aac0473f6455eec451011f016c84920520b19dfb

SHA512
b1d6872519f5956bb511b4eca8e1b79123482e9aacb1cef704c1d3ef7f9daade10573dd206df4c62c623bbfb10f757f01c914bfc2b0e9ab567981ea08b404799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
Filesize
446B

MD5
a72d70761b62d83237e2f5df550a43bd

SHA1
b61b5ac53b50499cca368a04c47b0ddc8c80e622

SHA256
7ab93ef8d9ff01bb2bc3aa761c24b1c199d562a923a3bbcb0b0c98dcb3c0feb5

SHA512
7b35350654ec75a409491f17d21d75d20bf479407c9387108cc27f5945d3277e974c2ceacde5441c2999338714dedb6ae659dc86ff0aff41d00f9acd87dae1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
f2f0d7b44b0e45abe717b0876cdd5328

SHA1
7b9c983349c23fb67181f800727b120db78e2449

SHA256
8147488d67d99c8acadde0f988f84976336ebb50a15af5303a83f955d6ffd0c7

SHA512
2cc366ef7cd95c35ee4b53b6d08a230c2d1e9509f721b0b64afed017092003386badde970eb89469a5c4a7fe14c24e960a41417bcda121eda2a1a2ec0182836b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ckj4gk4\imagestore.dat
Filesize
4KB

MD5
425c6b02ddffe84ed68af9bb0febae53

SHA1
9ab1e1553fee6f088bea23cece669ad4d00bd360

SHA256
929d6ba5648ce8ce15ddb1028ff660299fe1a2c3e2cb4d725c26696a5113f1b0

SHA512
2909ff6d06706186c732d9c7d142e907b6779c7e08352c7a106c13c21501d7fca43bdffbd846d82d7cf22bb5dd0f24fcf0e2b324732aff2bf27d92f17b960310

Download Submit
C:\Users\Admin\AppData\Local\Temp\8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb.exe
Filesize
376KB

MD5
459a9784acc3b399353d69f2fa3f8b5b

SHA1
5e5e865827862a57962f8e35b09d9bd13743e468

SHA256
8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb

SHA512
69c67f2f337955a1d7a90e0a497b8063ff1c3aa39bb4df8409be785b5201a6a86f59842b296bfd01e9258f3c3bb254b75ebf77477cdf2f7bb0dfd0c99509a41c

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
814KB

MD5
5e5f63cd0ca3ee94c61a2db20ce33fc9

SHA1
c90ea9645c7cc1ad7553675a7ecdf880b1fb4621

SHA256
219280ffebd3d771102fc3a7f26529e5e9161366e3a5de2f8943d81dda7756bf

SHA512
b36df698f1cbe52df754db9fcfba7e6811b6fc74f44a89378ce29356630f66a10d526402e9d133f8ab608bb614e2214945c0b732b4db3d0cad3d3665e062edcb

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
376KB

MD5
459a9784acc3b399353d69f2fa3f8b5b

SHA1
5e5e865827862a57962f8e35b09d9bd13743e468

SHA256
8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb

SHA512
69c67f2f337955a1d7a90e0a497b8063ff1c3aa39bb4df8409be785b5201a6a86f59842b296bfd01e9258f3c3bb254b75ebf77477cdf2f7bb0dfd0c99509a41c

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
376KB

MD5
459a9784acc3b399353d69f2fa3f8b5b

SHA1
5e5e865827862a57962f8e35b09d9bd13743e468

SHA256
8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb

SHA512
69c67f2f337955a1d7a90e0a497b8063ff1c3aa39bb4df8409be785b5201a6a86f59842b296bfd01e9258f3c3bb254b75ebf77477cdf2f7bb0dfd0c99509a41c

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
376KB

MD5
459a9784acc3b399353d69f2fa3f8b5b

SHA1
5e5e865827862a57962f8e35b09d9bd13743e468

SHA256
8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb

SHA512
69c67f2f337955a1d7a90e0a497b8063ff1c3aa39bb4df8409be785b5201a6a86f59842b296bfd01e9258f3c3bb254b75ebf77477cdf2f7bb0dfd0c99509a41c

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
Filesize
376KB

MD5
459a9784acc3b399353d69f2fa3f8b5b

SHA1
5e5e865827862a57962f8e35b09d9bd13743e468

SHA256
8deb6d11e709d78039023f7e935791d31c93846c1991c33dd061595499863feb

SHA512
69c67f2f337955a1d7a90e0a497b8063ff1c3aa39bb4df8409be785b5201a6a86f59842b296bfd01e9258f3c3bb254b75ebf77477cdf2f7bb0dfd0c99509a41c

Download Submit
memory/2164-149-0x0000000000000000-mapping.dmp

Download
memory/2264-135-0x0000000000000000-mapping.dmp

Download
memory/2376-136-0x0000000000000000-mapping.dmp

Download
memory/3508-134-0x0000000000000000-mapping.dmp

Download
memory/3684-144-0x0000000000000000-mapping.dmp

Download
memory/3728-150-0x0000000000000000-mapping.dmp

Download
memory/3980-151-0x0000000000000000-mapping.dmp

Download
memory/3980-156-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3980-158-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4084-148-0x0000000000000000-mapping.dmp

Download
memory/4376-133-0x0000000003900000-0x0000000003904000-memory.dmp

Filesize
16KB

Download
memory/4596-132-0x0000000000000000-mapping.dmp

Download
memory/4660-146-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4660-142-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4660-139-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4660-138-0x0000000000000000-mapping.dmp

Download