Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 11:00
Static task
static1
Behavioral task
behavioral1
Sample
545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe
-
Size
183KB
-
MD5
ead29687b7c4e76c59269e76a85341b7
-
SHA1
e4358328f8547d837e42fe5f9a516cba1b00c2ee
-
SHA256
545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0
-
SHA512
ba57dbb371e40f792f9e69d37bb54a74858890de72e4a5e01ccfb1f83053cb15e71de5fa25c8df748e299247ab34a3aed97acbc6153c01de7f5f348e5f043b5c
-
SSDEEP
3072:2PDMqqDLy/QmY2hDO1woouAq1cBGpH+H97k0n3i/Us3mPrONNKTdZdvj:ZqqDLuxv8VzA6cO23GUsWUNSn
Malware Config
Extracted
Family
netwire
C2
claraoliveira.serveblog.net:4100
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
24.01.17
-
lock_executable
false
-
offline_keylogger
false
-
password
Dr#JgN43K@i6@92E401g
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 23 IoCs
resource yara_rule behavioral1/memory/2616-3-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-13-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-15-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-17-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-19-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-29-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-31-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-33-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-35-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-37-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-39-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-43-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-45-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-47-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-49-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-51-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-53-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-55-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-59-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-61-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-63-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-65-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/2616-146491-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vinek.lnk 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1752 2616 WerFault.exe 28 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28 PID 2876 wrote to memory of 2616 2876 545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe"C:\Users\Admin\AppData\Local\Temp\545031fa5e8492908a4e9b61fdd6516e1ff4de7d7cbcf8d4a8347dfd8de466b0.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1163⤵
- Program crash
PID:1752
-
-