Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 00:39
Static task
static1
Behavioral task
behavioral1
Sample
e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe
Resource
win7-20220901-en
General
-
Target
e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe
-
Size
270KB
-
MD5
5d267f53327a67de1acddf9266224155
-
SHA1
8b1451eedc01931df48531127839617942df9461
-
SHA256
e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2
-
SHA512
6e78ee956342847c18c44de7274e46d7e7ea0bb801360f05af25b7e9d094b85bac54f5718d38d225581d942de63ac8ffaeb8ef41ef9e1cfc5bcbb18c44dbe5af
-
SSDEEP
6144:KJn2R2tg1G/joO7pAsnAAAAAA5r5f7T0jxaQbRbO194v5vQ73ABNAAAA82R9eT:KJW2tK2H7pAsnAAAAAAjkaQtbOMv5vQJ
Malware Config
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/996-78-0x0000000000402196-mapping.dmp netwire behavioral1/memory/996-77-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/996-75-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/996-82-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/996-85-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
Host.exepid process 1156 Host.exe -
Loads dropped DLL 1 IoCs
Processes:
RegSvcs.exepid process 996 RegSvcs.exe -
Drops file in System32 directory 1 IoCs
Processes:
msdtc.exedescription ioc process File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exeRegSvcs.exedescription pid process target process PID 1444 set thread context of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 568 set thread context of 996 568 RegSvcs.exe RegSvcs.exe -
Drops file in Windows directory 1 IoCs
Processes:
msdtc.exedescription ioc process File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exeRegSvcs.exeRegSvcs.exedescription pid process target process PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 1444 wrote to memory of 568 1444 e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 568 wrote to memory of 996 568 RegSvcs.exe RegSvcs.exe PID 996 wrote to memory of 1156 996 RegSvcs.exe Host.exe PID 996 wrote to memory of 1156 996 RegSvcs.exe Host.exe PID 996 wrote to memory of 1156 996 RegSvcs.exe Host.exe PID 996 wrote to memory of 1156 996 RegSvcs.exe Host.exe PID 996 wrote to memory of 1156 996 RegSvcs.exe Host.exe PID 996 wrote to memory of 1156 996 RegSvcs.exe Host.exe PID 996 wrote to memory of 1156 996 RegSvcs.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe"C:\Users\Admin\AppData\Local\Temp\e0fbcfe1224dc424aad75f66af776528917400202aa946d7ad2c85e2339c79e2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Drops file in System32 directory
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
32KB
MD5d79f070423fdd3f01ce8c2ba3fbbc8ed
SHA12f8ed26eb714b4efbe5d7a3167e33ade82c51fd8
SHA25697bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a
SHA51247bdc8cce5cd308053d9429a512924448e65023d154b798668d1ee8f628c1b548651e968e7c03db4a6770705f382b9e96db246c39f838000924985b53ccaa3db
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
32KB
MD5d79f070423fdd3f01ce8c2ba3fbbc8ed
SHA12f8ed26eb714b4efbe5d7a3167e33ade82c51fd8
SHA25697bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a
SHA51247bdc8cce5cd308053d9429a512924448e65023d154b798668d1ee8f628c1b548651e968e7c03db4a6770705f382b9e96db246c39f838000924985b53ccaa3db
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
32KB
MD5d79f070423fdd3f01ce8c2ba3fbbc8ed
SHA12f8ed26eb714b4efbe5d7a3167e33ade82c51fd8
SHA25697bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a
SHA51247bdc8cce5cd308053d9429a512924448e65023d154b798668d1ee8f628c1b548651e968e7c03db4a6770705f382b9e96db246c39f838000924985b53ccaa3db
-
memory/568-80-0x0000000074850000-0x0000000074DFB000-memory.dmpFilesize
5.7MB
-
memory/568-56-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/568-57-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/568-59-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/568-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/568-63-0x00000000004273EE-mapping.dmp
-
memory/568-62-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/568-67-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/568-65-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/996-78-0x0000000000402196-mapping.dmp
-
memory/996-85-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-75-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-71-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-77-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-70-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-82-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/996-73-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1156-84-0x0000000000000000-mapping.dmp
-
memory/1156-89-0x0000000074800000-0x0000000074DAB000-memory.dmpFilesize
5.7MB
-
memory/1156-90-0x0000000074800000-0x0000000074DAB000-memory.dmpFilesize
5.7MB
-
memory/1444-69-0x0000000074850000-0x0000000074DFB000-memory.dmpFilesize
5.7MB
-
memory/1444-54-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB
-
memory/1444-55-0x0000000074850000-0x0000000074DFB000-memory.dmpFilesize
5.7MB