Analysis
-
max time kernel
143s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 12:37
Static task
static1
Behavioral task
behavioral1
Sample
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe
Resource
win10v2004-20221111-en
General
-
Target
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe
-
Size
584KB
-
MD5
a6fbc836ee98068d35726e94cea20db4
-
SHA1
8a5109a69d1fcaf291ebf3e9a352d50a13800a03
-
SHA256
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
-
SHA512
af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
SSDEEP
6144:FeavY8R8Xw/gaeJ2Hoh3UhUVkHhFEIp+frI36qJ:FeavYJXw/aSKlkBFEIpwrIqqJ
Malware Config
Extracted
netwire
102.165.35.166:5000
-
activex_autorun
false
-
copy_executable
true
-
delete_original
true
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
gUkYbkwQ
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/948-66-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/948-65-0x0000000000400000-0x0000000000496000-memory.dmp netwire behavioral1/memory/1508-89-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1508-88-0x0000000000400000-0x0000000000496000-memory.dmp netwire behavioral1/memory/1508-96-0x0000000077DD0000-0x0000000077F50000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 560 Host.exe 1508 Host.exe -
Loads dropped DLL 2 IoCs
Processes:
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exepid process 948 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 948 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exeHost.exedescription pid process target process PID 2040 set thread context of 948 2040 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe PID 560 set thread context of 1508 560 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exeHost.exepid process 2040 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 560 Host.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exeHost.exedescription pid process target process PID 2040 wrote to memory of 948 2040 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe PID 2040 wrote to memory of 948 2040 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe PID 2040 wrote to memory of 948 2040 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe PID 2040 wrote to memory of 948 2040 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe PID 948 wrote to memory of 560 948 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe Host.exe PID 948 wrote to memory of 560 948 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe Host.exe PID 948 wrote to memory of 560 948 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe Host.exe PID 948 wrote to memory of 560 948 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe Host.exe PID 560 wrote to memory of 1508 560 Host.exe Host.exe PID 560 wrote to memory of 1508 560 Host.exe Host.exe PID 560 wrote to memory of 1508 560 Host.exe Host.exe PID 560 wrote to memory of 1508 560 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exeC:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exem "C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
584KB
MD5a6fbc836ee98068d35726e94cea20db4
SHA18a5109a69d1fcaf291ebf3e9a352d50a13800a03
SHA2567983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
SHA512af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
584KB
MD5a6fbc836ee98068d35726e94cea20db4
SHA18a5109a69d1fcaf291ebf3e9a352d50a13800a03
SHA2567983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
SHA512af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
584KB
MD5a6fbc836ee98068d35726e94cea20db4
SHA18a5109a69d1fcaf291ebf3e9a352d50a13800a03
SHA2567983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
SHA512af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
584KB
MD5a6fbc836ee98068d35726e94cea20db4
SHA18a5109a69d1fcaf291ebf3e9a352d50a13800a03
SHA2567983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
SHA512af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
584KB
MD5a6fbc836ee98068d35726e94cea20db4
SHA18a5109a69d1fcaf291ebf3e9a352d50a13800a03
SHA2567983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
SHA512af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
memory/560-74-0x0000000000000000-mapping.dmp
-
memory/560-86-0x0000000077DD0000-0x0000000077F50000-memory.dmpFilesize
1.5MB
-
memory/560-85-0x0000000077BF0000-0x0000000077D99000-memory.dmpFilesize
1.7MB
-
memory/560-84-0x0000000000280000-0x0000000000287000-memory.dmpFilesize
28KB
-
memory/948-60-0x000000000048940D-mapping.dmp
-
memory/948-78-0x0000000077DD0000-0x0000000077F50000-memory.dmpFilesize
1.5MB
-
memory/948-65-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB
-
memory/948-64-0x0000000077BF0000-0x0000000077D99000-memory.dmpFilesize
1.7MB
-
memory/948-66-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/948-75-0x0000000000220000-0x0000000000227000-memory.dmpFilesize
28KB
-
memory/1508-89-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1508-82-0x000000000048940D-mapping.dmp
-
memory/1508-88-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB
-
memory/1508-95-0x0000000077BF0000-0x0000000077D99000-memory.dmpFilesize
1.7MB
-
memory/1508-96-0x0000000077DD0000-0x0000000077F50000-memory.dmpFilesize
1.5MB
-
memory/2040-58-0x0000000077BF0000-0x0000000077D99000-memory.dmpFilesize
1.7MB
-
memory/2040-57-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/2040-59-0x0000000077DD0000-0x0000000077F50000-memory.dmpFilesize
1.5MB
-
memory/2040-56-0x00000000002C0000-0x00000000002C7000-memory.dmpFilesize
28KB
-
memory/2040-62-0x0000000077DD0000-0x0000000077F50000-memory.dmpFilesize
1.5MB
-
memory/2040-61-0x00000000002C0000-0x00000000002C7000-memory.dmpFilesize
28KB