Analysis
-
max time kernel
268s -
max time network
287s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 12:01
Static task
static1
Behavioral task
behavioral1
Sample
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe
Resource
win10v2004-20221111-en
General
-
Target
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe
-
Size
628KB
-
MD5
c12e964ba585f9a9857075b8eb65d76b
-
SHA1
1add8089079732146f8488279366e0edbb642dea
-
SHA256
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
-
SHA512
8f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
SSDEEP
12288:Z25oGFLgYE9jz/Y3GTG8LKa+pCxBU2wgWD1+KjLQZ3Ntkf4VTqKlA7yTE:0VFEYE9XA3GnLtRWD1W3sf4V+Xk
Malware Config
Extracted
netwire
mamaput.duckdns.org:3369
-
activex_autorun
true
-
activex_key
{BF4QBRQX-XB5B-3NJ1-P10G-U11UC07H0K2W}
-
copy_executable
true
-
delete_original
false
-
host_id
winwin
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
gbam1234
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4220-143-0x0000000000400000-0x00000000004A2000-memory.dmp netwire behavioral2/memory/4220-144-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1676 Host.exe 4968 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF4QBRQX-XB5B-3NJ1-P10G-U11UC07H0K2W} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF4QBRQX-XB5B-3NJ1-P10G-U11UC07H0K2W}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exeHost.exedescription pid process target process PID 3120 set thread context of 4220 3120 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe PID 1676 set thread context of 4968 1676 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exeHost.exepid process 3120 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 1676 Host.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exeHost.exedescription pid process target process PID 3120 wrote to memory of 4220 3120 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe PID 3120 wrote to memory of 4220 3120 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe PID 3120 wrote to memory of 4220 3120 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe PID 4220 wrote to memory of 1676 4220 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe Host.exe PID 4220 wrote to memory of 1676 4220 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe Host.exe PID 4220 wrote to memory of 1676 4220 709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe Host.exe PID 1676 wrote to memory of 4968 1676 Host.exe Host.exe PID 1676 wrote to memory of 4968 1676 Host.exe Host.exe PID 1676 wrote to memory of 4968 1676 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe"C:\Users\Admin\AppData\Local\Temp\709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exeC:\Users\Admin\AppData\Local\Temp\709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeC:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
628KB
MD5c12e964ba585f9a9857075b8eb65d76b
SHA11add8089079732146f8488279366e0edbb642dea
SHA256709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
SHA5128f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
628KB
MD5c12e964ba585f9a9857075b8eb65d76b
SHA11add8089079732146f8488279366e0edbb642dea
SHA256709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
SHA5128f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
628KB
MD5c12e964ba585f9a9857075b8eb65d76b
SHA11add8089079732146f8488279366e0edbb642dea
SHA256709135163dbab906237092fe63412c55c71dc4566ff8902c3728f1c22bce8d66
SHA5128f6cd53cb37b42a5078cd7a3488f2209e88b135a94dd0684a6f8d24417f389070b67ecb74e801dd3ff3392cd1e956e8ad32120fca6cdb36c8a7a9e23ee8e06f2
-
memory/1676-159-0x0000000077730000-0x00000000778D3000-memory.dmpFilesize
1.6MB
-
memory/1676-150-0x0000000000000000-mapping.dmp
-
memory/1676-158-0x00007FFF723D0000-0x00007FFF725C5000-memory.dmpFilesize
2.0MB
-
memory/1676-157-0x0000000002140000-0x0000000002147000-memory.dmpFilesize
28KB
-
memory/3120-137-0x00007FFF723D0000-0x00007FFF725C5000-memory.dmpFilesize
2.0MB
-
memory/3120-136-0x0000000002180000-0x0000000002187000-memory.dmpFilesize
28KB
-
memory/3120-138-0x0000000077730000-0x00000000778D3000-memory.dmpFilesize
1.6MB
-
memory/3120-134-0x0000000002180000-0x0000000002187000-memory.dmpFilesize
28KB
-
memory/4220-142-0x0000000077730000-0x00000000778D3000-memory.dmpFilesize
1.6MB
-
memory/4220-143-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4220-144-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4220-141-0x0000000000530000-0x0000000000537000-memory.dmpFilesize
28KB
-
memory/4220-169-0x00007FFF723D0000-0x00007FFF725C5000-memory.dmpFilesize
2.0MB
-
memory/4220-135-0x0000000000000000-mapping.dmp
-
memory/4220-140-0x0000000077730000-0x00000000778D3000-memory.dmpFilesize
1.6MB
-
memory/4220-139-0x00007FFF723D0000-0x00007FFF725C5000-memory.dmpFilesize
2.0MB
-
memory/4220-170-0x0000000077730000-0x00000000778D3000-memory.dmpFilesize
1.6MB
-
memory/4968-155-0x0000000000000000-mapping.dmp
-
memory/4968-168-0x0000000077730000-0x00000000778D3000-memory.dmpFilesize
1.6MB
-
memory/4968-167-0x00007FFF723D0000-0x00007FFF725C5000-memory.dmpFilesize
2.0MB
-
memory/4968-171-0x00000000020B0000-0x00000000020B7000-memory.dmpFilesize
28KB
-
memory/4968-172-0x00007FFF723D0000-0x00007FFF725C5000-memory.dmpFilesize
2.0MB
-
memory/4968-173-0x0000000077730000-0x00000000778D3000-memory.dmpFilesize
1.6MB