Analysis
-
max time kernel
150s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 19:10
Static task
static1
Behavioral task
behavioral1
Sample
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe
Resource
win10v2004-20220812-en
General
-
Target
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe
-
Size
512KB
-
MD5
2c51efce39512a806e21c71b9c1f2637
-
SHA1
9d2184814a40d27ca83c87ad477d7e351b0eea39
-
SHA256
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
-
SHA512
5c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
SSDEEP
6144:I1l11cqTBCC8MT7ggLrRzOpsPtJqRr4VD+lrA+uRD3VDuDp9B5Ep:I1l1ZTk7MgeFzCsPG2srf+TH
Malware Config
Extracted
netwire
185.165.153.135:9539
-
activex_autorun
true
-
activex_key
{ODFPY1S0-W63U-I6AD-W6R7-QY1P260KC61N}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
true
-
startup_name
Windows Defender
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3304-141-0x0000000000400000-0x0000000000487000-memory.dmp netwire behavioral2/memory/3304-142-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1480 Host.exe 2844 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ODFPY1S0-W63U-I6AD-W6R7-QY1P260KC61N} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ODFPY1S0-W63U-I6AD-W6R7-QY1P260KC61N}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exeHost.exedescription pid process target process PID 3924 set thread context of 3304 3924 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe PID 1480 set thread context of 2844 1480 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exeHost.exepid process 3924 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 1480 Host.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exeHost.exedescription pid process target process PID 3924 wrote to memory of 3304 3924 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe PID 3924 wrote to memory of 3304 3924 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe PID 3924 wrote to memory of 3304 3924 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe PID 3304 wrote to memory of 1480 3304 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe Host.exe PID 3304 wrote to memory of 1480 3304 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe Host.exe PID 3304 wrote to memory of 1480 3304 538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe Host.exe PID 1480 wrote to memory of 2844 1480 Host.exe Host.exe PID 1480 wrote to memory of 2844 1480 Host.exe Host.exe PID 1480 wrote to memory of 2844 1480 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe"C:\Users\Admin\AppData\Local\Temp\538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exeC:\Users\Admin\AppData\Local\Temp\538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeC:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
512KB
MD52c51efce39512a806e21c71b9c1f2637
SHA19d2184814a40d27ca83c87ad477d7e351b0eea39
SHA256538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
SHA5125c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
512KB
MD52c51efce39512a806e21c71b9c1f2637
SHA19d2184814a40d27ca83c87ad477d7e351b0eea39
SHA256538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
SHA5125c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
512KB
MD52c51efce39512a806e21c71b9c1f2637
SHA19d2184814a40d27ca83c87ad477d7e351b0eea39
SHA256538811ee7b9b53e1fdd7168db258ffa8f9dec5d1dd5cb2a0c6feb11a05e51f69
SHA5125c7cd2384faa28e47fd7961eb48de9aad00cb49eb9a2202749176ad524fc16363d7e98cd882656e7050f08cc264b429f31ea268979a201fce2a26e714e09b05a
-
memory/1480-148-0x0000000000000000-mapping.dmp
-
memory/1480-159-0x00007FFEC3BB0000-0x00007FFEC3DA5000-memory.dmpFilesize
2.0MB
-
memory/1480-160-0x0000000077BC0000-0x0000000077D63000-memory.dmpFilesize
1.6MB
-
memory/1480-158-0x0000000002110000-0x0000000002117000-memory.dmpFilesize
28KB
-
memory/2844-156-0x0000000000000000-mapping.dmp
-
memory/2844-169-0x0000000077BC0000-0x0000000077D63000-memory.dmpFilesize
1.6MB
-
memory/2844-168-0x00007FFEC3BB0000-0x00007FFEC3DA5000-memory.dmpFilesize
2.0MB
-
memory/3304-142-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3304-151-0x00000000005B0000-0x00000000005B7000-memory.dmpFilesize
28KB
-
memory/3304-153-0x00007FFEC3BB0000-0x00007FFEC3DA5000-memory.dmpFilesize
2.0MB
-
memory/3304-155-0x0000000077BC0000-0x0000000077D63000-memory.dmpFilesize
1.6MB
-
memory/3304-135-0x0000000000000000-mapping.dmp
-
memory/3304-141-0x0000000000400000-0x0000000000487000-memory.dmpFilesize
540KB
-
memory/3304-140-0x0000000077BC0000-0x0000000077D63000-memory.dmpFilesize
1.6MB
-
memory/3304-139-0x00007FFEC3BB0000-0x00007FFEC3DA5000-memory.dmpFilesize
2.0MB
-
memory/3924-136-0x0000000002240000-0x0000000002247000-memory.dmpFilesize
28KB
-
memory/3924-134-0x0000000002240000-0x0000000002247000-memory.dmpFilesize
28KB
-
memory/3924-137-0x00007FFEC3BB0000-0x00007FFEC3DA5000-memory.dmpFilesize
2.0MB
-
memory/3924-138-0x0000000077BC0000-0x0000000077D63000-memory.dmpFilesize
1.6MB