Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 17:48
Static task
static1
Behavioral task
behavioral1
Sample
15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe
Resource
win10v2004-20220812-en
General
-
Target
15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe
-
Size
222KB
-
MD5
76c090f1bbc12453b6046736daa7009b
-
SHA1
d18483537a06195adae4376b66ebb992fa4f39be
-
SHA256
15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d
-
SHA512
fe33ed15e6b13ad0e45222324ba75ebed11e6198427e2edd93d9ba7160b224f26e8062c0bdc3e8caff371e1a96940eae1c358da32aab9c819ce6559970194786
-
SSDEEP
3072:3hvsRJUV7ZdyQod/TGEMVmoEzlWln9b4ct+bIF6LjFkF3karC1t1TB1Me6i9E:RvHT/GMdExW96ctdcL+F3karCJFGe6k
Malware Config
Extracted
netwire
haija.mine.nu:1338
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
aegistools2
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
qays1122
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1460-55-0x0000000000150000-0x000000000017E000-memory.dmp netwire behavioral1/memory/1460-57-0x0000000000710000-0x0000000000743000-memory.dmp netwire behavioral1/memory/1536-63-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1536-64-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1536-65-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1536-67-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1536-69-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1536-68-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1536-72-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1536-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\BlueStacks.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BlueStacks.exe" 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exedescription pid process target process PID 1460 set thread context of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exedescription pid process target process PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe PID 1460 wrote to memory of 1536 1460 15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe"C:\Users\Admin\AppData\Local\Temp\15be0713bcd6b6c3ca2ca062a711fb979bdd00194dacf9635cf84ee69ad5854d.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1460-54-0x000000013FCC0000-0x000000013FCFC000-memory.dmpFilesize
240KB
-
memory/1460-55-0x0000000000150000-0x000000000017E000-memory.dmpFilesize
184KB
-
memory/1460-56-0x0000000000200000-0x0000000000208000-memory.dmpFilesize
32KB
-
memory/1460-57-0x0000000000710000-0x0000000000743000-memory.dmpFilesize
204KB
-
memory/1536-58-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-61-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-59-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-63-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-69-0x000000000040242D-mapping.dmp
-
memory/1536-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-71-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1536-72-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB