Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 00:19
Static task
static1
Behavioral task
behavioral1
Sample
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe
Resource
win10v2004-20220901-en
General
-
Target
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe
-
Size
136KB
-
MD5
45de34860d873e77958b13f5a93a3594
-
SHA1
0a2956f89b648e796b298ed929f72cb57a6f5b04
-
SHA256
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
-
SHA512
67d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
SSDEEP
3072:3b0X3trVAkbdOjJjnkAMVd+MIv1Zm67eu+1Rinqhm:rotrVAeEBnkA0dJh6iuKf
Malware Config
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2404-134-0x0000000000000000-mapping.dmp netwire behavioral2/memory/2404-135-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/2404-137-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/2404-141-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/4520-145-0x0000000000000000-mapping.dmp netwire behavioral2/memory/4520-150-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 2436 Host.exe 4520 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{MEKH86H8-LE5Y-3ULW-13KX-3NK2E51D8R0V} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{MEKH86H8-LE5Y-3ULW-13KX-3NK2E51D8R0V}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exeHost.exedescription pid process target process PID 4940 set thread context of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 2436 set thread context of 4520 2436 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exeHost.exepid process 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 2436 Host.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exeHost.exedescription pid process target process PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 4940 wrote to memory of 2404 4940 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe PID 2404 wrote to memory of 2436 2404 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe Host.exe PID 2404 wrote to memory of 2436 2404 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe Host.exe PID 2404 wrote to memory of 2436 2404 842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe PID 2436 wrote to memory of 4520 2436 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
136KB
MD545de34860d873e77958b13f5a93a3594
SHA10a2956f89b648e796b298ed929f72cb57a6f5b04
SHA256842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
SHA51267d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
136KB
MD545de34860d873e77958b13f5a93a3594
SHA10a2956f89b648e796b298ed929f72cb57a6f5b04
SHA256842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
SHA51267d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
136KB
MD545de34860d873e77958b13f5a93a3594
SHA10a2956f89b648e796b298ed929f72cb57a6f5b04
SHA256842e6dc655f79aec1f9a1f7804007f079d912db14b4758ccf68c8014a4c7aa82
SHA51267d7fcc0478fe3ed819fd46772560cb3bc5c2c374225d940992098b73c5317f77084360a117f414ea8278e606ce48424e2703b091d8e21362a82ff4c9df7c237
-
memory/2404-134-0x0000000000000000-mapping.dmp
-
memory/2404-135-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2404-137-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2404-141-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2436-139-0x0000000000000000-mapping.dmp
-
memory/4520-145-0x0000000000000000-mapping.dmp
-
memory/4520-150-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4940-138-0x00000000020F0000-0x00000000020F6000-memory.dmpFilesize
24KB