Analysis
-
max time kernel
149s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 12:37
Static task
static1
Behavioral task
behavioral1
Sample
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe
Resource
win10v2004-20221111-en
General
-
Target
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe
-
Size
584KB
-
MD5
a6fbc836ee98068d35726e94cea20db4
-
SHA1
8a5109a69d1fcaf291ebf3e9a352d50a13800a03
-
SHA256
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
-
SHA512
af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
SSDEEP
6144:FeavY8R8Xw/gaeJ2Hoh3UhUVkHhFEIp+frI36qJ:FeavYJXw/aSKlkBFEIpwrIqqJ
Malware Config
Extracted
netwire
102.165.35.166:5000
-
activex_autorun
false
-
copy_executable
true
-
delete_original
true
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
gUkYbkwQ
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
true
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4324-140-0x0000000000400000-0x0000000000496000-memory.dmp netwire behavioral2/memory/4324-142-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 4060 Host.exe 2464 Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exeHost.exedescription pid process target process PID 1344 set thread context of 4324 1344 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe PID 4060 set thread context of 2464 4060 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exeHost.exepid process 1344 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 4060 Host.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exeHost.exedescription pid process target process PID 1344 wrote to memory of 4324 1344 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe PID 1344 wrote to memory of 4324 1344 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe PID 1344 wrote to memory of 4324 1344 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe PID 4324 wrote to memory of 4060 4324 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe Host.exe PID 4324 wrote to memory of 4060 4324 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe Host.exe PID 4324 wrote to memory of 4060 4324 7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe Host.exe PID 4060 wrote to memory of 2464 4060 Host.exe Host.exe PID 4060 wrote to memory of 2464 4060 Host.exe Host.exe PID 4060 wrote to memory of 2464 4060 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exeC:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe-m "C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exem "C:\Users\Admin\AppData\Local\Temp\7983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
584KB
MD5a6fbc836ee98068d35726e94cea20db4
SHA18a5109a69d1fcaf291ebf3e9a352d50a13800a03
SHA2567983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
SHA512af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
584KB
MD5a6fbc836ee98068d35726e94cea20db4
SHA18a5109a69d1fcaf291ebf3e9a352d50a13800a03
SHA2567983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
SHA512af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
584KB
MD5a6fbc836ee98068d35726e94cea20db4
SHA18a5109a69d1fcaf291ebf3e9a352d50a13800a03
SHA2567983105a2e7c1b8248c6f3b7ad354eaeaa55eaf68da61359ca1305c478cbdcef
SHA512af9f026ae19ed725305a9ca2475027e3138d547d9db0a7b075bf81038d188c660542f6e95d8c27c0c6cf88ef11801bece689bb1137622aa1073a13c276a5326d
-
memory/1344-136-0x0000000002C80000-0x0000000002C87000-memory.dmpFilesize
28KB
-
memory/1344-137-0x00007FFAB4CF0000-0x00007FFAB4EE5000-memory.dmpFilesize
2.0MB
-
memory/1344-138-0x00000000774A0000-0x0000000077643000-memory.dmpFilesize
1.6MB
-
memory/1344-134-0x0000000002C80000-0x0000000002C87000-memory.dmpFilesize
28KB
-
memory/1344-148-0x00000000774A0000-0x0000000077643000-memory.dmpFilesize
1.6MB
-
memory/2464-171-0x00000000005C0000-0x00000000005C7000-memory.dmpFilesize
28KB
-
memory/2464-170-0x00000000774A0000-0x0000000077643000-memory.dmpFilesize
1.6MB
-
memory/2464-169-0x00007FFAB4CF0000-0x00007FFAB4EE5000-memory.dmpFilesize
2.0MB
-
memory/2464-157-0x0000000000000000-mapping.dmp
-
memory/4060-159-0x0000000002220000-0x0000000002227000-memory.dmpFilesize
28KB
-
memory/4060-149-0x0000000000000000-mapping.dmp
-
memory/4060-160-0x00007FFAB4CF0000-0x00007FFAB4EE5000-memory.dmpFilesize
2.0MB
-
memory/4060-161-0x00000000774A0000-0x0000000077643000-memory.dmpFilesize
1.6MB
-
memory/4324-154-0x00000000005E0000-0x00000000005E7000-memory.dmpFilesize
28KB
-
memory/4324-155-0x00007FFAB4CF0000-0x00007FFAB4EE5000-memory.dmpFilesize
2.0MB
-
memory/4324-156-0x00000000774A0000-0x0000000077643000-memory.dmpFilesize
1.6MB
-
memory/4324-142-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4324-140-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB
-
memory/4324-141-0x00000000774A0000-0x0000000077643000-memory.dmpFilesize
1.6MB
-
memory/4324-139-0x00007FFAB4CF0000-0x00007FFAB4EE5000-memory.dmpFilesize
2.0MB
-
memory/4324-135-0x0000000000000000-mapping.dmp