Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-04-2023 22:46
Behavioral task
behavioral1
Sample
21f0006a914bac1bcca71c4167e65585.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
21f0006a914bac1bcca71c4167e65585.exe
Resource
win10v2004-20230220-en
General
-
Target
21f0006a914bac1bcca71c4167e65585.exe
-
Size
148KB
-
MD5
21f0006a914bac1bcca71c4167e65585
-
SHA1
d33e3d8053a8068a1de57a6cfa54bde59c6761d7
-
SHA256
20a7088411ad98c4dd710ec1913d464e374b28d4873c26a0dcc2910e486b9323
-
SHA512
f84be9a43a136374b88d39ffaa263fa0bb2ef50c639ff2b649aec64f6ba9e4cc64860c99d3565c93662a17209df62200ef5b1b9309554ea643e18b31543f428c
-
SSDEEP
3072:ROzIy5XGViztldWl88Yed2DQuIAQvQ+d0aY1DLARX:Ro2ViztvWlvd2UuIAQvQ+yFVLAR
Malware Config
Extracted
netwire
fucktoto.duckdns.org:3369
-
activex_autorun
true
-
activex_key
{4KUJJ476-38ES-RCMH-QGW0-22030L368G76}
-
copy_executable
true
-
delete_original
false
-
host_id
blower
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
gbam1234
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
-
NetWire RAT payload 19 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Install\Host.exe netwire C:\Users\Admin\AppData\Roaming\Install\Host.exe netwire \Users\Admin\AppData\Roaming\Install\Host.exe netwire behavioral1/memory/1324-62-0x0000000000400000-0x0000000000425000-memory.dmp netwire C:\Users\Admin\AppData\Roaming\Install\Host.exe netwire behavioral1/memory/1980-64-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-65-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-66-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-67-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-68-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-69-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-70-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-71-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-72-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-73-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-74-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-75-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-76-0x0000000000400000-0x0000000000425000-memory.dmp netwire behavioral1/memory/1980-77-0x0000000000400000-0x0000000000425000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4KUJJ476-38ES-RCMH-QGW0-22030L368G76} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4KUJJ476-38ES-RCMH-QGW0-22030L368G76}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Executes dropped EXE 1 IoCs
Processes:
Host.exepid process 1980 Host.exe -
Loads dropped DLL 2 IoCs
Processes:
21f0006a914bac1bcca71c4167e65585.exepid process 1324 21f0006a914bac1bcca71c4167e65585.exe 1324 21f0006a914bac1bcca71c4167e65585.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
21f0006a914bac1bcca71c4167e65585.exedescription pid process target process PID 1324 wrote to memory of 1980 1324 21f0006a914bac1bcca71c4167e65585.exe Host.exe PID 1324 wrote to memory of 1980 1324 21f0006a914bac1bcca71c4167e65585.exe Host.exe PID 1324 wrote to memory of 1980 1324 21f0006a914bac1bcca71c4167e65585.exe Host.exe PID 1324 wrote to memory of 1980 1324 21f0006a914bac1bcca71c4167e65585.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f0006a914bac1bcca71c4167e65585.exe"C:\Users\Admin\AppData\Local\Temp\21f0006a914bac1bcca71c4167e65585.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
148KB
MD521f0006a914bac1bcca71c4167e65585
SHA1d33e3d8053a8068a1de57a6cfa54bde59c6761d7
SHA25620a7088411ad98c4dd710ec1913d464e374b28d4873c26a0dcc2910e486b9323
SHA512f84be9a43a136374b88d39ffaa263fa0bb2ef50c639ff2b649aec64f6ba9e4cc64860c99d3565c93662a17209df62200ef5b1b9309554ea643e18b31543f428c
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
148KB
MD521f0006a914bac1bcca71c4167e65585
SHA1d33e3d8053a8068a1de57a6cfa54bde59c6761d7
SHA25620a7088411ad98c4dd710ec1913d464e374b28d4873c26a0dcc2910e486b9323
SHA512f84be9a43a136374b88d39ffaa263fa0bb2ef50c639ff2b649aec64f6ba9e4cc64860c99d3565c93662a17209df62200ef5b1b9309554ea643e18b31543f428c
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
148KB
MD521f0006a914bac1bcca71c4167e65585
SHA1d33e3d8053a8068a1de57a6cfa54bde59c6761d7
SHA25620a7088411ad98c4dd710ec1913d464e374b28d4873c26a0dcc2910e486b9323
SHA512f84be9a43a136374b88d39ffaa263fa0bb2ef50c639ff2b649aec64f6ba9e4cc64860c99d3565c93662a17209df62200ef5b1b9309554ea643e18b31543f428c
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
148KB
MD521f0006a914bac1bcca71c4167e65585
SHA1d33e3d8053a8068a1de57a6cfa54bde59c6761d7
SHA25620a7088411ad98c4dd710ec1913d464e374b28d4873c26a0dcc2910e486b9323
SHA512f84be9a43a136374b88d39ffaa263fa0bb2ef50c639ff2b649aec64f6ba9e4cc64860c99d3565c93662a17209df62200ef5b1b9309554ea643e18b31543f428c
-
memory/1324-62-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-67-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-71-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-66-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-64-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-68-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-69-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-70-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-65-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-72-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-73-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-74-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-75-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-76-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1980-77-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB