Analysis
-
max time kernel
114s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 19:10
Static task
static1
Behavioral task
behavioral1
Sample
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe
Resource
win10v2004-20220812-en
General
-
Target
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe
-
Size
512KB
-
MD5
2c51efce39512a806e21c71b9c1f2637
-
SHA1
9d2184814a40d27ca83c87ad477d7e351b0eea39
-
SHA256
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
-
SHA512
5c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
SSDEEP
6144:I1l11cqTBCC8MT7ggLrRzOpsPtJqRr4VD+lrA+uRD3VDuDp9B5Ep:I1l1ZTk7MgeFzCsPG2srf+TH
Malware Config
Extracted
netwire
185.165.153.135:9539
-
activex_autorun
true
-
activex_key
{ODFPY1S0-W63U-I6AD-W6R7-QY1P260KC61N}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
true
-
startup_name
Windows Defender
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1348-64-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1348-63-0x0000000000400000-0x0000000000487000-memory.dmp netwire behavioral1/memory/932-87-0x0000000000400000-0x0000000000487000-memory.dmp netwire behavioral1/memory/932-88-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1100 Host.exe 932 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ODFPY1S0-W63U-I6AD-W6R7-QY1P260KC61N} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ODFPY1S0-W63U-I6AD-W6R7-QY1P260KC61N}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Loads dropped DLL 2 IoCs
Processes:
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exepid process 1348 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 1348 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exeHost.exedescription pid process target process PID 2000 set thread context of 1348 2000 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe PID 1100 set thread context of 932 1100 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exeHost.exepid process 2000 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 1100 Host.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exeHost.exedescription pid process target process PID 2000 wrote to memory of 1348 2000 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe PID 2000 wrote to memory of 1348 2000 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe PID 2000 wrote to memory of 1348 2000 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe PID 2000 wrote to memory of 1348 2000 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe PID 1348 wrote to memory of 1100 1348 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe Host.exe PID 1348 wrote to memory of 1100 1348 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe Host.exe PID 1348 wrote to memory of 1100 1348 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe Host.exe PID 1348 wrote to memory of 1100 1348 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe Host.exe PID 1100 wrote to memory of 932 1100 Host.exe Host.exe PID 1100 wrote to memory of 932 1100 Host.exe Host.exe PID 1100 wrote to memory of 932 1100 Host.exe Host.exe PID 1100 wrote to memory of 932 1100 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe"C:\Users\Admin\AppData\Local\Temp\538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exeC:\Users\Admin\AppData\Local\Temp\538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeC:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
512KB
MD52c51efce39512a806e21c71b9c1f2637
SHA19d2184814a40d27ca83c87ad477d7e351b0eea39
SHA256538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
SHA5125c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
512KB
MD52c51efce39512a806e21c71b9c1f2637
SHA19d2184814a40d27ca83c87ad477d7e351b0eea39
SHA256538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
SHA5125c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
512KB
MD52c51efce39512a806e21c71b9c1f2637
SHA19d2184814a40d27ca83c87ad477d7e351b0eea39
SHA256538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
SHA5125c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
512KB
MD52c51efce39512a806e21c71b9c1f2637
SHA19d2184814a40d27ca83c87ad477d7e351b0eea39
SHA256538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
SHA5125c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
512KB
MD52c51efce39512a806e21c71b9c1f2637
SHA19d2184814a40d27ca83c87ad477d7e351b0eea39
SHA256538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
SHA5125c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
memory/932-88-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/932-87-0x0000000000400000-0x0000000000487000-memory.dmpFilesize
540KB
-
memory/932-94-0x0000000076EE0000-0x0000000077089000-memory.dmpFilesize
1.7MB
-
memory/932-95-0x00000000770C0000-0x0000000077240000-memory.dmpFilesize
1.5MB
-
memory/932-81-0x0000000000472E8E-mapping.dmp
-
memory/1100-85-0x00000000770C0000-0x0000000077240000-memory.dmpFilesize
1.5MB
-
memory/1100-84-0x0000000076EE0000-0x0000000077089000-memory.dmpFilesize
1.7MB
-
memory/1100-72-0x0000000000000000-mapping.dmp
-
memory/1100-83-0x0000000000290000-0x0000000000297000-memory.dmpFilesize
28KB
-
memory/1348-64-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1348-78-0x00000000770C0000-0x0000000077240000-memory.dmpFilesize
1.5MB
-
memory/1348-76-0x0000000076EE0000-0x0000000077089000-memory.dmpFilesize
1.7MB
-
memory/1348-73-0x0000000000220000-0x0000000000227000-memory.dmpFilesize
28KB
-
memory/1348-63-0x0000000000400000-0x0000000000487000-memory.dmpFilesize
540KB
-
memory/1348-58-0x0000000000472E8E-mapping.dmp
-
memory/2000-56-0x0000000000280000-0x0000000000287000-memory.dmpFilesize
28KB
-
memory/2000-61-0x00000000770C0000-0x0000000077240000-memory.dmpFilesize
1.5MB
-
memory/2000-60-0x0000000076EE0000-0x0000000077089000-memory.dmpFilesize
1.7MB
-
memory/2000-59-0x0000000000280000-0x0000000000287000-memory.dmpFilesize
28KB
-
memory/2000-57-0x00000000754E1000-0x00000000754E3000-memory.dmpFilesize
8KB