Analysis
-
max time kernel
176s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 21:31
Static task
static1
Behavioral task
behavioral1
Sample
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe
Resource
win10v2004-20220812-en
General
-
Target
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe
-
Size
231KB
-
MD5
85d1383f02b7ce7df6c885b26dec358f
-
SHA1
36b4d98651e805ae6221a34fc32ded9e29dc2202
-
SHA256
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7
-
SHA512
9fe7ed08fea7256de6def7d3b7848f099753a4ed6365dc8fc3871d5c355ae12870d4a8858897e7a5537080ff2471274f40bb8746755ed2e55e40665edbc9f568
-
SSDEEP
6144:sIQQvbRHrYO7oHO7ADvifoFHig7wK2zU0uNE22Sv:VBThrYO7UzQEXwK2zU0uNE22S
Malware Config
Extracted
netwire
haija.mine.nu:9999
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
Aegistools
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
qays1122
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4632-134-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4632-135-0x000000000040242D-mapping.dmp netwire behavioral2/memory/4632-137-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4632-139-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlog.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlog.exe" ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exedescription pid process target process PID 4964 set thread context of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exedescription pid process target process PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe PID 4964 wrote to memory of 4632 4964 ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe"C:\Users\Admin\AppData\Local\Temp\ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4632-134-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4632-135-0x000000000040242D-mapping.dmp
-
memory/4632-137-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4632-139-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4964-132-0x0000000000130000-0x0000000000170000-memory.dmpFilesize
256KB
-
memory/4964-133-0x00007FFC61560000-0x00007FFC62021000-memory.dmpFilesize
10.8MB
-
memory/4964-138-0x00007FFC61560000-0x00007FFC62021000-memory.dmpFilesize
10.8MB