Analysis
- max time kernel
173s - max time network
185s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
07/01/2024, 03:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
47ed26d0a0f4d8a98d743f23a6e36c22.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
47ed26d0a0f4d8a98d743f23a6e36c22.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 47ed26d0a0f4d8a98d743f23a6e36c22.exe
- Size 1.0MB
- Sample240107-d6kyfadfbq
- SHA256 40cbbf504a6af3b5ad0d25cb02f4dc9544596d6978468b708c9f2248953a4e6c
- MD5 47ed26d0a0f4d8a98d743f23a6e36c22
- SHA1 bfa384cb2680435f734eb1913611ebe19231a609
- SHA512 2c54ccef260bf5dc24a81bfb0de7bc38f1f0308fc62f275ff839713d03e860619a3b491a6d2463b33d341d6a448df0bb3a62738c487c678d4557be496473f401
- SSDEEP 24576:VAHnh+eWsN3skA4RV1Hom2KXFmIaYx0tZVO55:Eh+ZkldoPK1XaYxcZVc
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
netwire
C2
-
95.167.151.235:8973
Attributes
-
activex_autorun
true
-
activex_key
{N0R5BAW8-0Q5K-W773-0566-88UJFGBT8MC5}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
true
-
startup_name
windows
-
use_mutex
false
Signatures
- NetWire RAT payload 2 IoCs
resource yara_rule behavioral2/memory/3248-4-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/3248-13-0x0000000000400000-0x000000000042C000-memory.dmp netwire - Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N0R5BAW8-0Q5K-W773-0566-88UJFGBT8MC5} 47ed26d0a0f4d8a98d743f23a6e36c22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N0R5BAW8-0Q5K-W773-0566-88UJFGBT8MC5}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\47ed26d0a0f4d8a98d743f23a6e36c22.exe\"" 47ed26d0a0f4d8a98d743f23a6e36c22.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N0R5BAW8-0Q5K-W773-0566-88UJFGBT8MC5} Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N0R5BAW8-0Q5K-W773-0566-88UJFGBT8MC5}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\"" Host.exe - Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\manage-bde.url 47ed26d0a0f4d8a98d743f23a6e36c22.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\manage-bde.url Host.exe - Executes dropped EXE 2 IoCs
pid Process 3120 Host.exe 2584 Host.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Local\\Temp\\47ed26d0a0f4d8a98d743f23a6e36c22.exe" 47ed26d0a0f4d8a98d743f23a6e36c22.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000200000001e7fd-16.dat autoit_exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1280 set thread context of 3248 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 96 PID 1280 set thread context of 4744 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 98 PID 3120 set thread context of 2584 3120 Host.exe 102 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 3120 Host.exe 3120 Host.exe 3120 Host.exe - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 3120 Host.exe 3120 Host.exe 3120 Host.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1280 wrote to memory of 3248 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 96 PID 1280 wrote to memory of 3248 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 96 PID 1280 wrote to memory of 3248 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 96 PID 1280 wrote to memory of 3248 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 96 PID 1280 wrote to memory of 3248 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 96 PID 3248 wrote to memory of 3120 3248 47ed26d0a0f4d8a98d743f23a6e36c22.exe 97 PID 3248 wrote to memory of 3120 3248 47ed26d0a0f4d8a98d743f23a6e36c22.exe 97 PID 3248 wrote to memory of 3120 3248 47ed26d0a0f4d8a98d743f23a6e36c22.exe 97 PID 1280 wrote to memory of 4744 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 98 PID 1280 wrote to memory of 4744 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 98 PID 1280 wrote to memory of 4744 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 98 PID 1280 wrote to memory of 4744 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 98 PID 1280 wrote to memory of 4744 1280 47ed26d0a0f4d8a98d743f23a6e36c22.exe 98 PID 3120 wrote to memory of 2584 3120 Host.exe 102 PID 3120 wrote to memory of 2584 3120 Host.exe 102 PID 3120 wrote to memory of 2584 3120 Host.exe 102 PID 3120 wrote to memory of 2584 3120 Host.exe 102 PID 3120 wrote to memory of 2584 3120 Host.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\47ed26d0a0f4d8a98d743f23a6e36c22.exe"C:\Users\Admin\AppData\Local\Temp\47ed26d0a0f4d8a98d743f23a6e36c22.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\47ed26d0a0f4d8a98d743f23a6e36c22.exe"C:\Users\Admin\AppData\Local\Temp\47ed26d0a0f4d8a98d743f23a6e36c22.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
PID:2584
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\47ed26d0a0f4d8a98d743f23a6e36c22.exe"C:\Users\Admin\AppData\Local\Temp\47ed26d0a0f4d8a98d743f23a6e36c22.exe"2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:4744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
- Size 1.0MB
- SHA256 40cbbf504a6af3b5ad0d25cb02f4dc9544596d6978468b708c9f2248953a4e6c
- MD5 47ed26d0a0f4d8a98d743f23a6e36c22
- SHA1 bfa384cb2680435f734eb1913611ebe19231a609
- SHA512 2c54ccef260bf5dc24a81bfb0de7bc38f1f0308fc62f275ff839713d03e860619a3b491a6d2463b33d341d6a448df0bb3a62738c487c678d4557be496473f401
- SSDEEP 24576:VAHnh+eWsN3skA4RV1Hom2KXFmIaYx0tZVO55:Eh+ZkldoPK1XaYxcZVc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\manage-bde.url
- Size 77B
- SHA256 caf506185b1378b2b4a856eb87943343b65ff59baf284c0ab8caa14630ea6b5c
- MD5 2bc950d2636bbc190dd77672c1e15a84
- SHA1 320443a43c8b8c214b395ee77c235c014f36da96
- SHA512 8c993cbd5b7edcb83067017eace023d6659e99d5654e79e057d881fdb698eda2bfda506623aa41e562d6592fbce3fc8fa4f9b651f5482032cf776b3dd8dbe585
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\manage-bde.vbs
- Size 105B
- SHA256 a107b661fde8b745b4b6e831b0fd7413dc39d628beec8e04e28e968c7e37fbda
- MD5 30b5c4918ac6f3f79d60c4cbccb66564
- SHA1 62a4c67b3e56edb117f1382ee7cb805ed226ebc4
- SHA512 8010b56dc271a50dae0e85d50d820dc8f74f662187cb5d9f5fffab02666619d2fe15daa5c86e9bcec0f2e3f331f57304f1ea0f995626483bd2d37fdd7f8f7c5d
- MD5 SHA1 SHA512