Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 23:01
Static task
static1
Behavioral task
behavioral1
Sample
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe
Resource
win10v2004-20221111-en
General
-
Target
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe
-
Size
620KB
-
MD5
bebb241c63e3f02435250a922e4a11ea
-
SHA1
1677b2321633d18a997f526cb8b9b623f1993822
-
SHA256
f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
-
SHA512
e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
SSDEEP
12288:gpmhvaV/QmkiLdEkKpFB1Gh7iRjACyALvuhj:Fv0/QxqzKOOYA4
Malware Config
Extracted
netwire
ahmed82.duckdns.org:31220
-
activex_autorun
true
-
activex_key
{MQ7E162C-G40B-POGC-BR10-W1R3U0M04M64}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-Nov%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/948-63-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/948-62-0x0000000000400000-0x000000000049C000-memory.dmp netwire behavioral1/memory/948-68-0x0000000076F30000-0x00000000770B0000-memory.dmp netwire behavioral1/memory/1736-85-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1736-84-0x0000000000400000-0x000000000049C000-memory.dmp netwire behavioral1/memory/1736-91-0x0000000076F30000-0x00000000770B0000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{MQ7E162C-G40B-POGC-BR10-W1R3U0M04M64} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{MQ7E162C-G40B-POGC-BR10-W1R3U0M04M64}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1368 Host.exe 1736 Host.exe -
Loads dropped DLL 2 IoCs
Processes:
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exepid process 948 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe 948 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeHost.exedescription pid process target process PID 1532 set thread context of 948 1532 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe PID 1368 set thread context of 1736 1368 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeHost.exepid process 1532 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe 1368 Host.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeF22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeHost.exedescription pid process target process PID 1532 wrote to memory of 948 1532 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe PID 1532 wrote to memory of 948 1532 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe PID 1532 wrote to memory of 948 1532 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe PID 1532 wrote to memory of 948 1532 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe PID 948 wrote to memory of 1368 948 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe Host.exe PID 948 wrote to memory of 1368 948 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe Host.exe PID 948 wrote to memory of 1368 948 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe Host.exe PID 948 wrote to memory of 1368 948 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe Host.exe PID 1368 wrote to memory of 1736 1368 Host.exe Host.exe PID 1368 wrote to memory of 1736 1368 Host.exe Host.exe PID 1368 wrote to memory of 1736 1368 Host.exe Host.exe PID 1368 wrote to memory of 1736 1368 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe"C:\Users\Admin\AppData\Local\Temp\F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeC:\Users\Admin\AppData\Local\Temp\F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeC:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
620KB
MD5bebb241c63e3f02435250a922e4a11ea
SHA11677b2321633d18a997f526cb8b9b623f1993822
SHA256f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
SHA512e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
620KB
MD5bebb241c63e3f02435250a922e4a11ea
SHA11677b2321633d18a997f526cb8b9b623f1993822
SHA256f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
SHA512e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
620KB
MD5bebb241c63e3f02435250a922e4a11ea
SHA11677b2321633d18a997f526cb8b9b623f1993822
SHA256f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
SHA512e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
620KB
MD5bebb241c63e3f02435250a922e4a11ea
SHA11677b2321633d18a997f526cb8b9b623f1993822
SHA256f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
SHA512e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
620KB
MD5bebb241c63e3f02435250a922e4a11ea
SHA11677b2321633d18a997f526cb8b9b623f1993822
SHA256f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
SHA512e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
memory/948-73-0x0000000076F30000-0x00000000770B0000-memory.dmpFilesize
1.5MB
-
memory/948-58-0x000000000048C341-mapping.dmp
-
memory/948-68-0x0000000076F30000-0x00000000770B0000-memory.dmpFilesize
1.5MB
-
memory/948-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/948-60-0x00000000003A0000-0x00000000003A8000-memory.dmpFilesize
32KB
-
memory/948-62-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1368-72-0x0000000000000000-mapping.dmp
-
memory/1368-82-0x0000000076F30000-0x00000000770B0000-memory.dmpFilesize
1.5MB
-
memory/1368-77-0x0000000000520000-0x0000000000528000-memory.dmpFilesize
32KB
-
memory/1532-56-0x0000000000390000-0x0000000000398000-memory.dmpFilesize
32KB
-
memory/1532-59-0x0000000076F30000-0x00000000770B0000-memory.dmpFilesize
1.5MB
-
memory/1532-57-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/1736-80-0x000000000048C341-mapping.dmp
-
memory/1736-85-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1736-84-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1736-91-0x0000000076F30000-0x00000000770B0000-memory.dmpFilesize
1.5MB
-
memory/1736-92-0x0000000076F30000-0x00000000770B0000-memory.dmpFilesize
1.5MB