Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 00:19
Static task
static1
Behavioral task
behavioral1
Sample
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe
Resource
win10v2004-20220901-en
General
-
Target
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe
-
Size
136KB
-
MD5
45de34860d873e77958b13f5a93a3594
-
SHA1
0a2956f89b648e796b298ed929f72cb57a6f5b04
-
SHA256
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
-
SHA512
67d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
SSDEEP
3072:3b0X3trVAkbdOjJjnkAMVd+MIv1Zm67eu+1Rinqhm:rotrVAeEBnkA0dJh6iuKf
Malware Config
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1996-57-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1996-58-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/1996-62-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1996-63-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/840-73-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/840-78-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 964 Host.exe 840 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{MEKH86H8-LE5Y-3ULW-13KX-3NK2E51D8R0V}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{MEKH86H8-LE5Y-3ULW-13KX-3NK2E51D8R0V} Host.exe -
Deletes itself 1 IoCs
Processes:
Host.exepid process 840 Host.exe -
Loads dropped DLL 2 IoCs
Processes:
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exepid process 1996 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 1996 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exeHost.exedescription pid process target process PID 1976 set thread context of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 964 set thread context of 840 964 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exeHost.exepid process 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 964 Host.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exeHost.exedescription pid process target process PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1976 wrote to memory of 1996 1976 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 1996 wrote to memory of 964 1996 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe Host.exe PID 1996 wrote to memory of 964 1996 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe Host.exe PID 1996 wrote to memory of 964 1996 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe Host.exe PID 1996 wrote to memory of 964 1996 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe PID 964 wrote to memory of 840 964 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Deletes itself
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
136KB
MD545de34860d873e77958b13f5a93a3594
SHA10a2956f89b648e796b298ed929f72cb57a6f5b04
SHA256842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
SHA51267d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
136KB
MD545de34860d873e77958b13f5a93a3594
SHA10a2956f89b648e796b298ed929f72cb57a6f5b04
SHA256842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
SHA51267d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
136KB
MD545de34860d873e77958b13f5a93a3594
SHA10a2956f89b648e796b298ed929f72cb57a6f5b04
SHA256842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
SHA51267d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
136KB
MD545de34860d873e77958b13f5a93a3594
SHA10a2956f89b648e796b298ed929f72cb57a6f5b04
SHA256842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
SHA51267d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
136KB
MD545de34860d873e77958b13f5a93a3594
SHA10a2956f89b648e796b298ed929f72cb57a6f5b04
SHA256842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
SHA51267d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
memory/840-73-0x00000000004021DA-mapping.dmp
-
memory/840-78-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/964-66-0x0000000000000000-mapping.dmp
-
memory/1976-56-0x0000000074D81000-0x0000000074D83000-memory.dmpFilesize
8KB
-
memory/1976-59-0x00000000003A0000-0x00000000003A6000-memory.dmpFilesize
24KB
-
memory/1996-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1996-63-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1996-58-0x00000000004021DA-mapping.dmp
-
memory/1996-57-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB