Analysis
-
max time kernel
426s -
max time network
482s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 22:14
Static task
static1
Behavioral task
behavioral1
Sample
02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe
Resource
win10v2004-20221111-en
General
-
Target
02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe
-
Size
149KB
-
MD5
d5193a1b6c0330d62f6ce1222c92e121
-
SHA1
39841d086cf7981e665ca10e020d4477a2ded5ff
-
SHA256
02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780
-
SHA512
76d791fbe73412fa0f9f5bffd938c4886a8c9a6f9a7b65136ef166c324e8c67ead3f096445547ccc531fa409b3dbe081d460bc0e453ffda6bb3505580e5b53b2
-
SSDEEP
3072:1sD7iquVhI0fyVMD8tgbDQiDFaIgSkSFWHy:2D7iquVVys8teYIgaWS
Malware Config
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4912-134-0x0000000000000000-mapping.dmp netwire behavioral2/memory/4912-135-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/4912-137-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/4912-140-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/1144-144-0x0000000000000000-mapping.dmp netwire behavioral2/memory/1144-149-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1352 Host.exe 1144 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ON0L586T-6SEA-58C6-J5H8-AJ6H23333E13} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ON0L586T-6SEA-58C6-J5H8-AJ6H23333E13}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsoft\\Host.exe\"" Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\microsoft\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exeHost.exedescription pid process target process PID 2940 set thread context of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 1352 set thread context of 1144 1352 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exeHost.exepid process 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 1352 Host.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exeHost.exedescription pid process target process PID 2940 wrote to memory of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 2940 wrote to memory of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 2940 wrote to memory of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 2940 wrote to memory of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 2940 wrote to memory of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 2940 wrote to memory of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 2940 wrote to memory of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 2940 wrote to memory of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 2940 wrote to memory of 4912 2940 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe PID 4912 wrote to memory of 1352 4912 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe Host.exe PID 4912 wrote to memory of 1352 4912 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe Host.exe PID 4912 wrote to memory of 1352 4912 02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe Host.exe PID 1352 wrote to memory of 1144 1352 Host.exe Host.exe PID 1352 wrote to memory of 1144 1352 Host.exe Host.exe PID 1352 wrote to memory of 1144 1352 Host.exe Host.exe PID 1352 wrote to memory of 1144 1352 Host.exe Host.exe PID 1352 wrote to memory of 1144 1352 Host.exe Host.exe PID 1352 wrote to memory of 1144 1352 Host.exe Host.exe PID 1352 wrote to memory of 1144 1352 Host.exe Host.exe PID 1352 wrote to memory of 1144 1352 Host.exe Host.exe PID 1352 wrote to memory of 1144 1352 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe"C:\Users\Admin\AppData\Local\Temp\02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe"C:\Users\Admin\AppData\Local\Temp\02e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsoft\Host.exe"C:\Users\Admin\AppData\Roaming\microsoft\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsoft\Host.exe"C:\Users\Admin\AppData\Roaming\microsoft\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Host.exeFilesize
149KB
MD5d5193a1b6c0330d62f6ce1222c92e121
SHA139841d086cf7981e665ca10e020d4477a2ded5ff
SHA25602e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780
SHA51276d791fbe73412fa0f9f5bffd938c4886a8c9a6f9a7b65136ef166c324e8c67ead3f096445547ccc531fa409b3dbe081d460bc0e453ffda6bb3505580e5b53b2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Host.exeFilesize
149KB
MD5d5193a1b6c0330d62f6ce1222c92e121
SHA139841d086cf7981e665ca10e020d4477a2ded5ff
SHA25602e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780
SHA51276d791fbe73412fa0f9f5bffd938c4886a8c9a6f9a7b65136ef166c324e8c67ead3f096445547ccc531fa409b3dbe081d460bc0e453ffda6bb3505580e5b53b2
-
C:\Users\Admin\AppData\Roaming\microsoft\Host.exeFilesize
149KB
MD5d5193a1b6c0330d62f6ce1222c92e121
SHA139841d086cf7981e665ca10e020d4477a2ded5ff
SHA25602e2f374592453f9f876b18edce1a0031dcabbbfba71d53975ef27d17c8e3780
SHA51276d791fbe73412fa0f9f5bffd938c4886a8c9a6f9a7b65136ef166c324e8c67ead3f096445547ccc531fa409b3dbe081d460bc0e453ffda6bb3505580e5b53b2
-
memory/1144-144-0x0000000000000000-mapping.dmp
-
memory/1144-149-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1352-138-0x0000000000000000-mapping.dmp
-
memory/4912-134-0x0000000000000000-mapping.dmp
-
memory/4912-135-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4912-137-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4912-140-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB