Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 23:01
Static task
static1
Behavioral task
behavioral1
Sample
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe
Resource
win10v2004-20221111-en
General
-
Target
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe
-
Size
620KB
-
MD5
bebb241c63e3f02435250a922e4a11ea
-
SHA1
1677b2321633d18a997f526cb8b9b623f1993822
-
SHA256
f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
-
SHA512
e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
SSDEEP
12288:gpmhvaV/QmkiLdEkKpFB1Gh7iRjACyALvuhj:Fv0/QxqzKOOYA4
Malware Config
Extracted
netwire
ahmed82.duckdns.org:31220
-
activex_autorun
true
-
activex_key
{MQ7E162C-G40B-POGC-BR10-W1R3U0M04M64}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-Nov%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1808-139-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/1808-138-0x0000000000400000-0x000000000049C000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{MQ7E162C-G40B-POGC-BR10-W1R3U0M04M64} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{MQ7E162C-G40B-POGC-BR10-W1R3U0M04M64}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 212 Host.exe 3736 Host.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeHost.exedescription pid process target process PID 4336 set thread context of 1808 4336 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe PID 212 set thread context of 3736 212 Host.exe Host.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeHost.exepid process 4336 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe 212 Host.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeF22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeHost.exedescription pid process target process PID 4336 wrote to memory of 1808 4336 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe PID 4336 wrote to memory of 1808 4336 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe PID 4336 wrote to memory of 1808 4336 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe PID 1808 wrote to memory of 212 1808 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe Host.exe PID 1808 wrote to memory of 212 1808 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe Host.exe PID 1808 wrote to memory of 212 1808 F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe Host.exe PID 212 wrote to memory of 3736 212 Host.exe Host.exe PID 212 wrote to memory of 3736 212 Host.exe Host.exe PID 212 wrote to memory of 3736 212 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe"C:\Users\Admin\AppData\Local\Temp\F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exeC:\Users\Admin\AppData\Local\Temp\F22BF2BD431D6E2B93C8485C99537383FE4B775C70CA5.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeC:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
620KB
MD5bebb241c63e3f02435250a922e4a11ea
SHA11677b2321633d18a997f526cb8b9b623f1993822
SHA256f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
SHA512e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
620KB
MD5bebb241c63e3f02435250a922e4a11ea
SHA11677b2321633d18a997f526cb8b9b623f1993822
SHA256f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
SHA512e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
620KB
MD5bebb241c63e3f02435250a922e4a11ea
SHA11677b2321633d18a997f526cb8b9b623f1993822
SHA256f22bf2bd431d6e2b93c8485c99537383fe4b775c70ca5633ffaf702fde170b7f
SHA512e266cea313d1d29e46644e7de31d3167919793c65b60f7c38a1e05cc80c83dd2554adeeb1462b3f9a47ddd69ecc49e9a78997a9e2768dc6a0f602f4bf0fad58e
-
memory/212-145-0x0000000000000000-mapping.dmp
-
memory/212-154-0x0000000077390000-0x0000000077533000-memory.dmpFilesize
1.6MB
-
memory/212-151-0x00000000005E0000-0x00000000005E8000-memory.dmpFilesize
32KB
-
memory/1808-148-0x0000000077390000-0x0000000077533000-memory.dmpFilesize
1.6MB
-
memory/1808-135-0x0000000000000000-mapping.dmp
-
memory/1808-137-0x00000000020A0000-0x00000000020A8000-memory.dmpFilesize
32KB
-
memory/1808-138-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1808-139-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3736-152-0x0000000000000000-mapping.dmp
-
memory/3736-162-0x0000000077390000-0x0000000077533000-memory.dmpFilesize
1.6MB
-
memory/3736-163-0x0000000077390000-0x0000000077533000-memory.dmpFilesize
1.6MB
-
memory/4336-136-0x0000000077390000-0x0000000077533000-memory.dmpFilesize
1.6MB
-
memory/4336-134-0x0000000002AF0000-0x0000000002AF8000-memory.dmpFilesize
32KB