Analysis
-
max time kernel
124s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 12:01
Static task
static1
Behavioral task
behavioral1
Sample
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe
Resource
win10v2004-20221111-en
General
-
Target
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe
-
Size
628KB
-
MD5
c12e964ba585f9a9857075b8eb65d76b
-
SHA1
1add8089079732146f8488279366e0edbb642dea
-
SHA256
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
-
SHA512
8f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
SSDEEP
12288:Z25oGFLgYE9jz/Y3GTG8LKa+pCxBU2wgWD1+KjLQZ3Ntkf4VTqKlA7yTE:0VFEYE9XA3GnLtRWD1W3sf4V+Xk
Malware Config
Extracted
netwire
mamaput.duckdns.org:3369
-
activex_autorun
true
-
activex_key
{BF4QBRQX-XB5B-3NJ1-P10G-U11UC07H0K2W}
-
copy_executable
true
-
delete_original
false
-
host_id
winwin
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
gbam1234
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1376-64-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1376-63-0x0000000000400000-0x00000000004A2000-memory.dmp netwire behavioral1/memory/560-88-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/560-87-0x0000000000400000-0x00000000004A2000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 544 Host.exe 560 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BF4QBRQX-XB5B-3NJ1-P10G-U11UC07H0K2W} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BF4QBRQX-XB5B-3NJ1-P10G-U11UC07H0K2W}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Loads dropped DLL 2 IoCs
Processes:
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exepid process 1376 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 1376 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exeHost.exedescription pid process target process PID 960 set thread context of 1376 960 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe PID 544 set thread context of 560 544 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exeHost.exepid process 960 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 544 Host.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exeHost.exedescription pid process target process PID 960 wrote to memory of 1376 960 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe PID 960 wrote to memory of 1376 960 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe PID 960 wrote to memory of 1376 960 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe PID 960 wrote to memory of 1376 960 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe PID 1376 wrote to memory of 544 1376 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe Host.exe PID 1376 wrote to memory of 544 1376 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe Host.exe PID 1376 wrote to memory of 544 1376 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe Host.exe PID 1376 wrote to memory of 544 1376 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe Host.exe PID 544 wrote to memory of 560 544 Host.exe Host.exe PID 544 wrote to memory of 560 544 Host.exe Host.exe PID 544 wrote to memory of 560 544 Host.exe Host.exe PID 544 wrote to memory of 560 544 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe"C:\Users\Admin\AppData\Local\Temp\709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exeC:\Users\Admin\AppData\Local\Temp\709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeC:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
628KB
MD5c12e964ba585f9a9857075b8eb65d76b
SHA11add8089079732146f8488279366e0edbb642dea
SHA256709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
SHA5128f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
628KB
MD5c12e964ba585f9a9857075b8eb65d76b
SHA11add8089079732146f8488279366e0edbb642dea
SHA256709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
SHA5128f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
628KB
MD5c12e964ba585f9a9857075b8eb65d76b
SHA11add8089079732146f8488279366e0edbb642dea
SHA256709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
SHA5128f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
628KB
MD5c12e964ba585f9a9857075b8eb65d76b
SHA11add8089079732146f8488279366e0edbb642dea
SHA256709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
SHA5128f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
628KB
MD5c12e964ba585f9a9857075b8eb65d76b
SHA11add8089079732146f8488279366e0edbb642dea
SHA256709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
SHA5128f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
memory/544-72-0x0000000000000000-mapping.dmp
-
memory/544-85-0x0000000077970000-0x0000000077AF0000-memory.dmpFilesize
1.5MB
-
memory/544-84-0x0000000077790000-0x0000000077939000-memory.dmpFilesize
1.7MB
-
memory/544-83-0x0000000000300000-0x0000000000307000-memory.dmpFilesize
28KB
-
memory/560-94-0x0000000077790000-0x0000000077939000-memory.dmpFilesize
1.7MB
-
memory/560-81-0x0000000000403C6B-mapping.dmp
-
memory/560-95-0x0000000077970000-0x0000000077AF0000-memory.dmpFilesize
1.5MB
-
memory/560-96-0x0000000000260000-0x0000000000267000-memory.dmpFilesize
28KB
-
memory/560-87-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/560-88-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/960-56-0x0000000000270000-0x0000000000277000-memory.dmpFilesize
28KB
-
memory/960-57-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/960-61-0x0000000077970000-0x0000000077AF0000-memory.dmpFilesize
1.5MB
-
memory/960-60-0x0000000077790000-0x0000000077939000-memory.dmpFilesize
1.7MB
-
memory/960-59-0x0000000000270000-0x0000000000277000-memory.dmpFilesize
28KB
-
memory/1376-78-0x0000000077970000-0x0000000077AF0000-memory.dmpFilesize
1.5MB
-
memory/1376-63-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1376-58-0x0000000000403C6B-mapping.dmp
-
memory/1376-64-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1376-76-0x0000000077790000-0x0000000077939000-memory.dmpFilesize
1.7MB
-
memory/1376-73-0x0000000000220000-0x0000000000227000-memory.dmpFilesize
28KB