Analysis
- max time kernel
143s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/04/2024, 13:32
Behavioral task
behavioral1
Sample
b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
General
- Target b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe
- Size 138KB
- Sample240410-qs383shd69
- SHA256 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f
- MD5 6be54d26001bd55770e3259562046ab2
- SHA1 8bbf5e6a646d077eba233adbc130b6ef132a6eac
- SHA512 a86aaf88e6e2c5c8ba7844714a997c03a4aa1c95eabf12276e6342080e3db385a6c04dcf96ca9a2998550b98dea25e293082e6db3408d920f769820a35f4ef4c
- SSDEEP 3072:Gmya12fDaJb/q7xCo0GVil+RefgcZgVcJ7iyVcoutPa:GC2aJby7xCIisRHQgVq7SoSPa
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
netwire
C2
-
atlaswebportal.zapto.org:4000
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
1.6_R1_26.12.15
-
keylogger_dir
C:\NVIDIA\profile\
-
lock_executable
false
-
offline_keylogger
true
-
password
Micr0s0ft4456877
-
registry_autorun
false
-
use_mutex
false
Extracted
Family
-
latentbot
C2
-
atlaswebportal.zapto.org
Signatures
- NetWire RAT payload 2 IoCs
resource yara_rule behavioral2/memory/4460-4-0x0000000000400000-0x0000000000421000-memory.dmp netwire behavioral2/memory/4460-12-0x0000000000400000-0x0000000000421000-memory.dmp netwire -
resource yara_rule behavioral2/memory/1600-0-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/memory/4460-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4460-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1600-6-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/memory/4460-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4460-12-0x0000000000400000-0x0000000000421000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88 PID 1600 wrote to memory of 4460 1600 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe"C:\Users\Admin\AppData\Local\Temp\b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe"C:\Users\Admin\AppData\Local\Temp\b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f.exe"2⤵PID:4460
-