Analysis
-
max time kernel
119s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 18:26
Static task
static1
Behavioral task
behavioral1
Sample
285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe
Resource
win10v2004-20220901-en
General
-
Target
285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe
-
Size
544KB
-
MD5
82cf92967ff37089ac670b63f2dd45e6
-
SHA1
37cdf11edd5bf245d7d0ab61939c920270ec8cbe
-
SHA256
285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1
-
SHA512
4658d213a8e4688d156b32f393092d1474679544488b11f72c439e0feb1ff18ebcbbf7c83d49f6e0e947670aab244e4481b28b3c8dbfd382452bfbb1591e2323
-
SSDEEP
12288:zWkjHZV+Lfb1CnBOeMLpjOxpA+Ua2Hj+:qGlBHMZLY
Malware Config
Extracted
netwire
212.7.208.123:8765
-
activex_autorun
true
-
activex_key
{L501JP3X-C6PC-RH36-475X-RS2C2OQHHGS0}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
true
-
startup_name
windows
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1676-139-0x0000000000400000-0x000000000048A000-memory.dmp netwire behavioral2/memory/1676-140-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1588 Host.exe 3652 Host.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{L501JP3X-C6PC-RH36-475X-RS2C2OQHHGS0} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{L501JP3X-C6PC-RH36-475X-RS2C2OQHHGS0}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exeHost.exedescription pid process target process PID 5064 set thread context of 1676 5064 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe PID 1588 set thread context of 3652 1588 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exeHost.exepid process 5064 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe 1588 Host.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exeHost.exedescription pid process target process PID 5064 wrote to memory of 1676 5064 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe PID 5064 wrote to memory of 1676 5064 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe PID 5064 wrote to memory of 1676 5064 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe PID 1676 wrote to memory of 1588 1676 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe Host.exe PID 1676 wrote to memory of 1588 1676 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe Host.exe PID 1676 wrote to memory of 1588 1676 285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe Host.exe PID 1588 wrote to memory of 3652 1588 Host.exe Host.exe PID 1588 wrote to memory of 3652 1588 Host.exe Host.exe PID 1588 wrote to memory of 3652 1588 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe"C:\Users\Admin\AppData\Local\Temp\285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe"C:\Users\Admin\AppData\Local\Temp\285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
544KB
MD582cf92967ff37089ac670b63f2dd45e6
SHA137cdf11edd5bf245d7d0ab61939c920270ec8cbe
SHA256285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1
SHA5124658d213a8e4688d156b32f393092d1474679544488b11f72c439e0feb1ff18ebcbbf7c83d49f6e0e947670aab244e4481b28b3c8dbfd382452bfbb1591e2323
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
544KB
MD582cf92967ff37089ac670b63f2dd45e6
SHA137cdf11edd5bf245d7d0ab61939c920270ec8cbe
SHA256285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1
SHA5124658d213a8e4688d156b32f393092d1474679544488b11f72c439e0feb1ff18ebcbbf7c83d49f6e0e947670aab244e4481b28b3c8dbfd382452bfbb1591e2323
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
544KB
MD582cf92967ff37089ac670b63f2dd45e6
SHA137cdf11edd5bf245d7d0ab61939c920270ec8cbe
SHA256285074cbfbb186cb746a1e03a3b3ca95cb3611987c0aab3433978268fb590aa1
SHA5124658d213a8e4688d156b32f393092d1474679544488b11f72c439e0feb1ff18ebcbbf7c83d49f6e0e947670aab244e4481b28b3c8dbfd382452bfbb1591e2323
-
memory/1588-148-0x0000000000000000-mapping.dmp
-
memory/1588-158-0x0000000000760000-0x0000000000768000-memory.dmpFilesize
32KB
-
memory/1588-160-0x0000000077BD0000-0x0000000077D73000-memory.dmpFilesize
1.6MB
-
memory/1588-159-0x00007FFC65B90000-0x00007FFC65D85000-memory.dmpFilesize
2.0MB
-
memory/1676-151-0x00000000004D0000-0x00000000004D8000-memory.dmpFilesize
32KB
-
memory/1676-144-0x00007FFC65B90000-0x00007FFC65D85000-memory.dmpFilesize
2.0MB
-
memory/1676-139-0x0000000000400000-0x000000000048A000-memory.dmpFilesize
552KB
-
memory/1676-140-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1676-147-0x0000000077BD0000-0x0000000077D73000-memory.dmpFilesize
1.6MB
-
memory/1676-135-0x0000000000000000-mapping.dmp
-
memory/1676-153-0x00007FFC65B90000-0x00007FFC65D85000-memory.dmpFilesize
2.0MB
-
memory/1676-154-0x0000000077BD0000-0x0000000077D73000-memory.dmpFilesize
1.6MB
-
memory/3652-156-0x0000000000000000-mapping.dmp
-
memory/3652-168-0x00007FFC65B90000-0x00007FFC65D85000-memory.dmpFilesize
2.0MB
-
memory/3652-169-0x0000000077BD0000-0x0000000077D73000-memory.dmpFilesize
1.6MB
-
memory/5064-138-0x0000000077BD0000-0x0000000077D73000-memory.dmpFilesize
1.6MB
-
memory/5064-136-0x0000000002A50000-0x0000000002A58000-memory.dmpFilesize
32KB
-
memory/5064-134-0x0000000002A50000-0x0000000002A58000-memory.dmpFilesize
32KB
-
memory/5064-137-0x00007FFC65B90000-0x00007FFC65D85000-memory.dmpFilesize
2.0MB