Analysis
- max time kernel
146s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/04/2024, 10:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
- Target 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
- Size 168KB
- Sample240410-m3c8vsdc72
- SHA256 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5
- MD5 ac65e7d08e48c6d20e3f90f7d9f73d8b
- SHA1 1dc7aa5ededab0009c6e693d2f713da4fd85cb17
- SHA512 8ca3bda79d5427d2476e5ea2a20682c76c4dc34673f36b1499cc492d1bd2a31be24a45b9a15e15f28de92c1aa48256722814b2d6827de606f4e907595f16e372
- SSDEEP 3072:2wUTTMqqDLy/0hSO4aMH8s/0K/dM7ry4VtmOo/KhtLL1YZYTb7Qw5:3qqDLu0hSjau/0K/UW47JrLxQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
netwire
C2
-
atlaswebportal.zapto.org:4000
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
1.6_R1_18.06.16
-
keylogger_dir
C:\NVIDIA\profile\
-
lock_executable
false
-
offline_keylogger
true
-
password
Micr0s0ft4456877
-
registry_autorun
false
-
use_mutex
false
Extracted
Family
-
latentbot
C2
-
atlaswebportal.zapto.org
Signatures
- NetWire RAT payload 3 IoCs
resource yara_rule behavioral2/memory/436-5-0x0000000000400000-0x0000000000421000-memory.dmp netwire behavioral2/memory/436-10-0x0000000000400000-0x0000000000421000-memory.dmp netwire behavioral2/memory/436-14-0x0000000000400000-0x0000000000421000-memory.dmp netwire -
resource yara_rule behavioral2/memory/436-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/436-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/436-5-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/436-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/436-14-0x0000000000400000-0x0000000000421000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95 PID 972 wrote to memory of 436 972 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe"C:\Users\Admin\AppData\Local\Temp\534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:436
-