Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2023 19:55
Static task
static1
Behavioral task
behavioral1
Sample
Final_Test.exe
Resource
win10-20230621-en
Behavioral task
behavioral2
Sample
Final_Test.exe
Resource
win10v2004-20230621-en
General
-
Target
Final_Test.exe
-
Size
530KB
-
MD5
ce6ba3df1d57ade7830c5315d77c9311
-
SHA1
251e75ac4468d26f76eaa9fe6458e169d3757dd4
-
SHA256
ce8bbc09521bc9bd7a358e4fbbe370962e22b91a78c8d895716ef98a1daaaf77
-
SHA512
b35cd30bd0ed8a4faab706ec0ec0c5c2494764f5a4a8f6cf416341f868a257e54f8d0ecbfd6523f3fc42fc914dd487a5cc14d86f433a8c5ae8775e131f4c50e6
-
SSDEEP
12288:0/dqneaMkgoWOtT1oslIRJUfLKvxMiFS9/j+esTCmuPcB:0/dqe1PoZt5HMgLo2micB
Malware Config
Extracted
lokibot
http://meta-mim.in/wp-includes/js/pzy/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Extracted
netwire
iheuche009.hopto.org:1199
-
activex_autorun
true
-
activex_key
{84B0DIYX-PC63-6D34-570T-YW54Q1M2RH7A}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
IRobWUAG
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
Avast
-
use_mutex
true
Signatures
-
NetWire RAT payload 7 IoCs
resource yara_rule behavioral2/files/0x0009000000023154-174.dat netwire behavioral2/files/0x0009000000023154-177.dat netwire behavioral2/files/0x0009000000023154-176.dat netwire behavioral2/memory/3856-184-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/files/0x0007000000023156-183.dat netwire behavioral2/files/0x0007000000023156-182.dat netwire behavioral2/memory/3316-203-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84B0DIYX-PC63-6D34-570T-YW54Q1M2RH7A} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84B0DIYX-PC63-6D34-570T-YW54Q1M2RH7A}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation Final_Test.exe -
Executes dropped EXE 3 IoCs
pid Process 2184 build.exe 3856 Host.exe 3316 Host.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook build.exe Key opened \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook build.exe Key opened \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook build.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Final_Test.exe Set value (str) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Final_Test.exe = "C:\\Users\\Admin\\AppData\\Roaming/Microsoft/Skype.exe" Final_Test.exe Key created \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avast = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{DF679188-4B85-4BEB-B47E-FFE3D0F33415}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D4155EAC-7DD2-4526-8997-B8B2A596B4C4}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{BE3C34E8-5BF2-4CE5-88EA-ED25D0538B02}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{465F5137-3B33-4766-AB14-F60CC2C6B814}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{DC93D604-4F31-4862-AA67-51702B5CF8F4}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{914C19B7-23A9-4479-B914-9BD0E886FAB4}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4714CA2A-F28B-466C-BFDD-972687A24489}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D9C8F729-4A81-41FF-9598-6083BBA524FA}.catalogItem svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4844 set thread context of 3264 4844 Final_Test.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2184 build.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4844 wrote to memory of 3264 4844 Final_Test.exe 94 PID 4844 wrote to memory of 3264 4844 Final_Test.exe 94 PID 4844 wrote to memory of 3264 4844 Final_Test.exe 94 PID 4844 wrote to memory of 3264 4844 Final_Test.exe 94 PID 4844 wrote to memory of 3264 4844 Final_Test.exe 94 PID 3264 wrote to memory of 2184 3264 Final_Test.exe 95 PID 3264 wrote to memory of 2184 3264 Final_Test.exe 95 PID 3264 wrote to memory of 2184 3264 Final_Test.exe 95 PID 3264 wrote to memory of 3856 3264 Final_Test.exe 97 PID 3264 wrote to memory of 3856 3264 Final_Test.exe 97 PID 3264 wrote to memory of 3856 3264 Final_Test.exe 97 PID 3856 wrote to memory of 3316 3856 Host.exe 98 PID 3856 wrote to memory of 3316 3856 Host.exe 98 PID 3856 wrote to memory of 3316 3856 Host.exe 98 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook build.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook build.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Final_Test.exe"C:\Users\Admin\AppData\Local\Temp\Final_Test.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\Final_Test.exe"C:\Users\Admin\AppData\Local\Temp\Final_Test.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\Host.exe"C:\Users\Admin\AppData\Local\Temp\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
PID:3316
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:5112
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5881779ca64253b8849df903a23e6d652
SHA1f564352d587ebea5527de51b7bd1269a47355973
SHA256863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d
SHA5122aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94
-
Filesize
132KB
MD5881779ca64253b8849df903a23e6d652
SHA1f564352d587ebea5527de51b7bd1269a47355973
SHA256863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d
SHA5122aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94
-
Filesize
132KB
MD5881779ca64253b8849df903a23e6d652
SHA1f564352d587ebea5527de51b7bd1269a47355973
SHA256863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d
SHA5122aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94
-
Filesize
104KB
MD52ef5474132e3e48b54855c7629fdce2e
SHA14687a86f96c2a48bbe92ca089ee0543ed4c1e5a4
SHA256264be6eafb7620e695684bf9a27ce807a1a5d711117bc9b65e27bc80a39912d6
SHA512dbace6f32bc717909bac540c204c2b9ed1d45266ba4a2feebb5c56fb192a07c9e48fa4df46e68986a1145ae969a8e8f3e2bf5427b9084261a40ef041335c0bba
-
Filesize
104KB
MD52ef5474132e3e48b54855c7629fdce2e
SHA14687a86f96c2a48bbe92ca089ee0543ed4c1e5a4
SHA256264be6eafb7620e695684bf9a27ce807a1a5d711117bc9b65e27bc80a39912d6
SHA512dbace6f32bc717909bac540c204c2b9ed1d45266ba4a2feebb5c56fb192a07c9e48fa4df46e68986a1145ae969a8e8f3e2bf5427b9084261a40ef041335c0bba
-
Filesize
104KB
MD52ef5474132e3e48b54855c7629fdce2e
SHA14687a86f96c2a48bbe92ca089ee0543ed4c1e5a4
SHA256264be6eafb7620e695684bf9a27ce807a1a5d711117bc9b65e27bc80a39912d6
SHA512dbace6f32bc717909bac540c204c2b9ed1d45266ba4a2feebb5c56fb192a07c9e48fa4df46e68986a1145ae969a8e8f3e2bf5427b9084261a40ef041335c0bba
-
Filesize
132KB
MD5881779ca64253b8849df903a23e6d652
SHA1f564352d587ebea5527de51b7bd1269a47355973
SHA256863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d
SHA5122aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94
-
Filesize
132KB
MD5881779ca64253b8849df903a23e6d652
SHA1f564352d587ebea5527de51b7bd1269a47355973
SHA256863a19222eecc560657e64d720a5b64a28e972a7ea5a7983c98343694ffe284d
SHA5122aff2f984f561ce0d5ae60b529da7cfdec35e02e28d8e9de27346e8c078bccf42c0bd882d7f8e0c70a0aea3bc6592489ee1bb7cc7cd3d1206547610efce26a94
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3259792829-1422303781-2047321929-1000\0f5007522459c86e95ffcc62f32308f1_7a0b5f63-92b5-4443-b457-34250c67f41d
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61