Analysis
-
max time kernel
159s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 13:04
Static task
static1
Behavioral task
behavioral1
Sample
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe
Resource
win10v2004-20221111-en
General
-
Target
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe
-
Size
135KB
-
MD5
692b1db3fea79f385ed85d15feca3955
-
SHA1
42c13949b1e49ffadc32be77431acd40456a21b8
-
SHA256
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
-
SHA512
ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
SSDEEP
3072:SYgJCrO1n2KJBnoq+dlSzb5Rz1t8EYS93zFonc4fM:SYzeJBUq/zgtA0f
Malware Config
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3368-137-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/3368-140-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/3368-142-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/1144-155-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/1144-157-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Executes dropped EXE 4 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exejusched.exepid process 2456 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 3368 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 3280 jusched.exe 1144 jusched.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
jusched.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1GG20K4-1W75-5CRS-K553-Q6J8UK5U1272} jusched.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1GG20K4-1W75-5CRS-K553-Q6J8UK5U1272}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\jusched.exe\"" jusched.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
REG.exejusched.exeREG.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7030 = "C:\\Users\\Admin\\AppData\\Roaming\\jusched.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ jusched.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Platform = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\jusched.exe" jusched.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7030 = "C:\\Users\\Admin\\AppData\\Roaming\\jusched.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exedescription pid process target process PID 1376 set thread context of 3368 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 3280 set thread context of 1144 3280 jusched.exe jusched.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exepid process 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 3280 jusched.exe 3280 jusched.exe 3280 jusched.exe 3280 jusched.exe 3280 jusched.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exedescription pid process Token: SeDebugPrivilege 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe Token: SeDebugPrivilege 3280 jusched.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exejusched.exedescription pid process target process PID 1376 wrote to memory of 2456 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 2456 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 2456 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 3368 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 3368 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 3368 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 3368 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 3368 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 3368 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 3368 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 3368 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe PID 1376 wrote to memory of 1340 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe REG.exe PID 1376 wrote to memory of 1340 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe REG.exe PID 1376 wrote to memory of 1340 1376 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe REG.exe PID 3368 wrote to memory of 3280 3368 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe jusched.exe PID 3368 wrote to memory of 3280 3368 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe jusched.exe PID 3368 wrote to memory of 3280 3368 05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe jusched.exe PID 3280 wrote to memory of 1144 3280 jusched.exe jusched.exe PID 3280 wrote to memory of 1144 3280 jusched.exe jusched.exe PID 3280 wrote to memory of 1144 3280 jusched.exe jusched.exe PID 3280 wrote to memory of 1144 3280 jusched.exe jusched.exe PID 3280 wrote to memory of 1144 3280 jusched.exe jusched.exe PID 3280 wrote to memory of 1144 3280 jusched.exe jusched.exe PID 3280 wrote to memory of 1144 3280 jusched.exe jusched.exe PID 3280 wrote to memory of 1144 3280 jusched.exe jusched.exe PID 3280 wrote to memory of 4792 3280 jusched.exe REG.exe PID 3280 wrote to memory of 4792 3280 jusched.exe REG.exe PID 3280 wrote to memory of 4792 3280 jusched.exe REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exe"C:\Users\Admin\AppData\Roaming\Install\jusched.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exe"C:\Users\Admin\AppData\Roaming\Install\jusched.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "7030" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\jusched.exe4⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "7030" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\jusched.exe2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
C:\Users\Admin\AppData\Local\Temp\05d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
C:\Users\Admin\AppData\Roaming\Install\jusched.exeFilesize
135KB
MD5692b1db3fea79f385ed85d15feca3955
SHA142c13949b1e49ffadc32be77431acd40456a21b8
SHA25605d814601ce7585966aa48b5697684a316f64d989aab32434f4a5f007b452b15
SHA512ff8430f4531a642d2fe7b935f578d99b8a71129245822f012dea594593b402942a39952d527ab170b722618e14913b80d810e28e126fb2939d0a918920940148
-
memory/1144-155-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1144-157-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1144-149-0x0000000000000000-mapping.dmp
-
memory/1340-141-0x0000000000000000-mapping.dmp
-
memory/1376-146-0x0000000075270000-0x0000000075821000-memory.dmpFilesize
5.7MB
-
memory/1376-132-0x0000000075270000-0x0000000075821000-memory.dmpFilesize
5.7MB
-
memory/1376-133-0x0000000075270000-0x0000000075821000-memory.dmpFilesize
5.7MB
-
memory/2456-134-0x0000000000000000-mapping.dmp
-
memory/3280-143-0x0000000000000000-mapping.dmp
-
memory/3280-147-0x0000000075270000-0x0000000075821000-memory.dmpFilesize
5.7MB
-
memory/3280-148-0x0000000075270000-0x0000000075821000-memory.dmpFilesize
5.7MB
-
memory/3280-156-0x0000000075270000-0x0000000075821000-memory.dmpFilesize
5.7MB
-
memory/3368-142-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3368-140-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3368-137-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3368-136-0x0000000000000000-mapping.dmp
-
memory/4792-152-0x0000000000000000-mapping.dmp