Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 13:04
Static task
static1
Behavioral task
behavioral1
Sample
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe
Resource
win10v2004-20221111-en
General
-
Target
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe
-
Size
135KB
-
MD5
692b1db3fea79f385ed85d15feca3955
-
SHA1
42c13949b1e49ffadc32be77431acd40456a21b8
-
SHA256
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
-
SHA512
ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
SSDEEP
3072:SYgJCrO1n2KJBnoq+dlSzb5Rz1t8EYS93zFonc4fM:SYzeJBUq/zgtA0f
Malware Config
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/624-64-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/624-66-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/624-67-0x0000000000402196-mapping.dmp netwire behavioral1/memory/624-71-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/624-76-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/1664-90-0x0000000000402196-mapping.dmp netwire behavioral1/memory/1664-97-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 4 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exejusched.exepid process 1152 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 624 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 580 jusched.exe 1664 jusched.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
jusched.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E1GG20K4-1W75-5CRS-K553-Q6J8UK5U1272} jusched.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E1GG20K4-1W75-5CRS-K553-Q6J8UK5U1272}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\jusched.exe\"" jusched.exe -
Loads dropped DLL 4 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exepid process 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 624 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 624 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
jusched.exeREG.exeREG.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Platform = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\jusched.exe" jusched.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\7030 = "C:\\Users\\Admin\\AppData\\Roaming\\jusched.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\7030 = "C:\\Users\\Admin\\AppData\\Roaming\\jusched.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ jusched.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exedescription pid process target process PID 1352 set thread context of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 580 set thread context of 1664 580 jusched.exe jusched.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exepid process 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 580 jusched.exe 580 jusched.exe 580 jusched.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exedescription pid process Token: SeDebugPrivilege 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe Token: SeDebugPrivilege 580 jusched.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exedescription pid process target process PID 1352 wrote to memory of 1152 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 1152 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 1152 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 1152 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1352 wrote to memory of 624 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 624 wrote to memory of 580 624 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe jusched.exe PID 624 wrote to memory of 580 624 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe jusched.exe PID 624 wrote to memory of 580 624 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe jusched.exe PID 624 wrote to memory of 580 624 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe jusched.exe PID 1352 wrote to memory of 1404 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe REG.exe PID 1352 wrote to memory of 1404 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe REG.exe PID 1352 wrote to memory of 1404 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe REG.exe PID 1352 wrote to memory of 1404 1352 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe REG.exe PID 580 wrote to memory of 1664 580 jusched.exe jusched.exe PID 580 wrote to memory of 1664 580 jusched.exe jusched.exe PID 580 wrote to memory of 1664 580 jusched.exe jusched.exe PID 580 wrote to memory of 1664 580 jusched.exe jusched.exe PID 580 wrote to memory of 1664 580 jusched.exe jusched.exe PID 580 wrote to memory of 1664 580 jusched.exe jusched.exe PID 580 wrote to memory of 1664 580 jusched.exe jusched.exe PID 580 wrote to memory of 1664 580 jusched.exe jusched.exe PID 580 wrote to memory of 1664 580 jusched.exe jusched.exe PID 580 wrote to memory of 1540 580 jusched.exe REG.exe PID 580 wrote to memory of 1540 580 jusched.exe REG.exe PID 580 wrote to memory of 1540 580 jusched.exe REG.exe PID 580 wrote to memory of 1540 580 jusched.exe REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exe"C:\Users\Admin\AppData\Roaming\Install\jusched.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exe"C:\Users\Admin\AppData\Roaming\Install\jusched.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "7030" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\jusched.exe4⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "7030" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\jusched.exe2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
\Users\Admin\AppData\Roaming\Install\jusched.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
\Users\Admin\AppData\Roaming\Install\jusched.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
memory/580-96-0x0000000074140000-0x00000000746EB000-memory.dmpFilesize
5.7MB
-
memory/580-79-0x0000000074140000-0x00000000746EB000-memory.dmpFilesize
5.7MB
-
memory/580-74-0x0000000000000000-mapping.dmp
-
memory/624-60-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/624-59-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/624-76-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/624-67-0x0000000000402196-mapping.dmp
-
memory/624-66-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/624-64-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/624-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/624-71-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1352-54-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB
-
memory/1352-81-0x0000000074140000-0x00000000746EB000-memory.dmpFilesize
5.7MB
-
memory/1352-55-0x0000000074140000-0x00000000746EB000-memory.dmpFilesize
5.7MB
-
memory/1404-80-0x0000000000000000-mapping.dmp
-
memory/1540-93-0x0000000000000000-mapping.dmp
-
memory/1664-90-0x0000000000402196-mapping.dmp
-
memory/1664-97-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB