Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2023 08:18
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe
Resource
win7-20230220-en
General
-
Target
HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe
-
Size
389KB
-
MD5
da276444d26b555c6c794248df8019c7
-
SHA1
13bcf9ee210e4130a45dbde394b5e242e34af2e3
-
SHA256
d25e23199a7c7f97e3e21ff927d53002353f22f299c41dca7cd3cdc3cae6531d
-
SHA512
4574da66f92cbae2e4b81558a93c28af5ad716dbab9ca6758744ec2a821c9aef36347f3f1418e4d84940bc3baaac5b59377ab224598a2fecc6b3197b8daa8cd6
-
SSDEEP
6144:93PyM/PNbjuSR81Uwzqs52CEhuA0Xop90V/az3Ws2of1Q:RPyCV/o/qUWDAopyV/rZof1Q
Malware Config
Extracted
netwire
william1979.ddns.net:4416
mathkros79.ddns.net:4416
engine79.ddns.net:4416
chrisle79.ddns.net:4416
jacknop79.ddns.net:4416
smath79.ddns.net:4416
whatis79.ddns.net:4416
goodgt79.ddns.net:4416
bonding79.ddns.net:4416
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
Jan 2018
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password2$
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 14 IoCs
resource yara_rule behavioral2/files/0x000e00000001ef51-144.dat netwire behavioral2/files/0x000e00000001ef51-146.dat netwire behavioral2/files/0x000e00000001ef51-147.dat netwire behavioral2/memory/4768-152-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/4768-156-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/4768-162-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/1464-166-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/4768-167-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/1464-169-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/1464-171-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/1464-173-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/1464-175-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/1464-177-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/1464-179-0x0000000000400000-0x0000000000420000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe -
Executes dropped EXE 2 IoCs
pid Process 1464 tmp.exe 4768 svhost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1680 set thread context of 4768 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3532 timeout.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1680 wrote to memory of 116 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 85 PID 1680 wrote to memory of 116 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 85 PID 1680 wrote to memory of 116 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 85 PID 116 wrote to memory of 4272 116 cmd.exe 88 PID 116 wrote to memory of 4272 116 cmd.exe 88 PID 116 wrote to memory of 4272 116 cmd.exe 88 PID 1680 wrote to memory of 1464 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 89 PID 1680 wrote to memory of 1464 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 89 PID 1680 wrote to memory of 1464 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 89 PID 1680 wrote to memory of 4768 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 90 PID 1680 wrote to memory of 4768 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 90 PID 1680 wrote to memory of 4768 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 90 PID 1680 wrote to memory of 4768 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 90 PID 1680 wrote to memory of 4768 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 90 PID 1680 wrote to memory of 4768 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 90 PID 1680 wrote to memory of 4768 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 90 PID 1680 wrote to memory of 4768 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 90 PID 1680 wrote to memory of 3212 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 91 PID 1680 wrote to memory of 3212 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 91 PID 1680 wrote to memory of 3212 1680 HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe 91 PID 3212 wrote to memory of 3532 3212 cmd.exe 93 PID 3212 wrote to memory of 3532 3212 cmd.exe 93 PID 3212 wrote to memory of 3532 3212 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.Win32.Generic-d25e23199a7c7f97e.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk" /f3⤵PID:4272
-
-
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"2⤵
- Executes dropped EXE
PID:1464
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
PID:4768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderN\name.exe.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
PID:3532
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD584c42d0f2c1ae761bef884638bc1eacd
SHA14353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA51243c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
-
Filesize
89KB
MD584c42d0f2c1ae761bef884638bc1eacd
SHA14353881e7f4e9c7610f4e0489183b55bb58bb574
SHA256331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
SHA51243c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
-
Filesize
389KB
MD5da276444d26b555c6c794248df8019c7
SHA113bcf9ee210e4130a45dbde394b5e242e34af2e3
SHA256d25e23199a7c7f97e3e21ff927d53002353f22f299c41dca7cd3cdc3cae6531d
SHA5124574da66f92cbae2e4b81558a93c28af5ad716dbab9ca6758744ec2a821c9aef36347f3f1418e4d84940bc3baaac5b59377ab224598a2fecc6b3197b8daa8cd6
-
Filesize
189B
MD5dca86f6bec779bba1b58d992319e88db
SHA1844e656d3603d15ae56f36298f8031ad52935829
SHA256413b4ee68f5400fcd30ae5df957d723989b400637dbc7f5d158fa050bdc20743
SHA5124b9d532a777921543b3243020ea4b655a8b956c400b237ce714b5bd8e9a3ad7fdbcb11410e84e2e0ecc45e87dcd107385a487f5bb5b359aabd1322314ef2d24c
-
Filesize
89KB
MD59c393cac6ef1c3282e3daf6ec50b79de
SHA134afa77f3d276191c278d56fa870d11c5069f48e
SHA2567231c7a76d9c4d0a307197522a2aec968f31865a4b2c4b962b64b01e9229315b
SHA51282543c3b43d10616ff9687e468ab75f3e96d0f0fdc795df2ef341b91c4ef915b0bad5bfbf6916939d40596d9bcd3190a1371bced3be16513768cc096c9c9b66e
-
Filesize
89KB
MD59c393cac6ef1c3282e3daf6ec50b79de
SHA134afa77f3d276191c278d56fa870d11c5069f48e
SHA2567231c7a76d9c4d0a307197522a2aec968f31865a4b2c4b962b64b01e9229315b
SHA51282543c3b43d10616ff9687e468ab75f3e96d0f0fdc795df2ef341b91c4ef915b0bad5bfbf6916939d40596d9bcd3190a1371bced3be16513768cc096c9c9b66e
-
Filesize
89KB
MD59c393cac6ef1c3282e3daf6ec50b79de
SHA134afa77f3d276191c278d56fa870d11c5069f48e
SHA2567231c7a76d9c4d0a307197522a2aec968f31865a4b2c4b962b64b01e9229315b
SHA51282543c3b43d10616ff9687e468ab75f3e96d0f0fdc795df2ef341b91c4ef915b0bad5bfbf6916939d40596d9bcd3190a1371bced3be16513768cc096c9c9b66e