netwire | 878d2d7e6bc21b888be0c88716d0457fbb224f3d27263be509180aaf8aa4f611

Analysis

max time kernel
70s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b41fb9385c0ac13fc08f3fda2098ac0N.exe
Size

118KB
MD5

3b41fb9385c0ac13fc08f3fda2098ac0
SHA1

979c54b5e2d8afec33bc69ffb7a35a81a14264c8
SHA256

878d2d7e6bc21b888be0c88716d0457fbb224f3d27263be509180aaf8aa4f611
SHA512

d54d1109c7689c2867d4c8bb41667005717c36404e094316f9dc35a7810561867588d10f5da303656e087e76de5e0f9996b47c24f6f1b2e8128d36bb5ae280e8
SSDEEP

3072:M+z7JXnrdFzp886+RMPy5fWMwdWRgjnahKoutjKI7ehMx:rz75nrz286+RMaLVRgjahKoS

Score

10^/10

netwire botnet discovery persistence rat stealer upx

Malware Config

Extracted

Family

netwire

imemerit.servehttp.com:3360

Attributes

activex_autorun
true
activex_key
{I78G8V27-88UF-2L1T-8064-2S8723OVASE8}
copy_executable
false
delete_original
true
host_id
HostId-%Rand%
keylogger_dir
C:\Users\Admin\AppData\Roaming\Logs\
lock_executable
false
mutex
TIrKHSHH
offline_keylogger
true
password
`+8n0x<gT)\"Lu5"'A`c?$H="
registry_autorun
true
startup_name
FirstRowAli
use_mutex
true

Signatures

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3864-77-0x0000000000400000-0x000000000041A000-memory.dmp	netwire
behavioral2/memory/3864-100-0x0000000000400000-0x000000000041A000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{I78G8V27-88UF-2L1T-8064-2S8723OVASE8}	FirstRow.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{I78G8V27-88UF-2L1T-8064-2S8723OVASE8}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\FirstRow.pif\""	FirstRow.pif

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	FirstRow.pif
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	3b41fb9385c0ac13fc08f3fda2098ac0N.exe

Executes dropped EXE 4 IoCs

pid	Process
4328	FirstRow.pif
4364	FirstRow.pif
924	FirstRow.pif
3864	FirstRow.pif

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5044-0-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/5044-6-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/4568-12-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4568-14-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/408-24-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/408-27-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/408-22-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/4568-16-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/5044-31-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/files/0x00070000000234a7-37.dat	upx
behavioral2/memory/4328-41-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/408-40-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/4568-44-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4568-45-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4328-47-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/4568-66-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/3864-75-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/3864-74-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4328-76-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral2/memory/3864-72-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/3864-77-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4364-84-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/924-87-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/4568-93-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/3864-100-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4568-137-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4364-192-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4568-218-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4568-237-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FirstRowAli = "C:\\Users\\Admin\\AppData\\Roaming\\FirstRow.pif"	FirstRow.pif

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5044 set thread context of 4568	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	96
PID 5044 set thread context of 408	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	98
PID 4328 set thread context of 4364	4328	FirstRow.pif	105
PID 4328 set thread context of 924	4328	FirstRow.pif	106
PID 4328 set thread context of 3864	4328	FirstRow.pif	118

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
708	4552	WerFault.exe	111
4888	5024	WerFault.exe	116
2800	4884	WerFault.exe	121
1784	632	WerFault.exe	126
3500	3792	WerFault.exe	130
4920	2424	WerFault.exe	134
1080	1168	WerFault.exe	138
4484	4720	WerFault.exe	142
2856	2712	WerFault.exe	146
1592	4868	WerFault.exe	150
1548	540	WerFault.exe	154
836	2892	WerFault.exe	158
2836	1204	WerFault.exe	162
4972	396	WerFault.exe	166
1080	504	WerFault.exe	170
1032	4660	WerFault.exe	174
2976	2464	WerFault.exe	180
2504	2684	WerFault.exe	186
3972	1524	WerFault.exe	190
4820	2116	WerFault.exe	194
2440	4704	WerFault.exe	198
2564	4880	WerFault.exe	202
3852	2012	WerFault.exe	206
3988	532	WerFault.exe	210
3168	2964	WerFault.exe	214
372	1096	WerFault.exe	218
1548	4168	WerFault.exe	222
4328	2728	WerFault.exe	226

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FirstRow.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FirstRow.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FirstRow.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FirstRow.pif

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4524	ipconfig.exe
2892	ipconfig.exe
632	ipconfig.exe
1168	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif
Token: SeDebugPrivilege	924	FirstRow.pif

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
408	3b41fb9385c0ac13fc08f3fda2098ac0N.exe
4328	FirstRow.pif
924	FirstRow.pif
4364	FirstRow.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2892	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	95
PID 5044 wrote to memory of 2892	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	95
PID 5044 wrote to memory of 2892	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	95
PID 5044 wrote to memory of 4568	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	96
PID 5044 wrote to memory of 4568	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	96
PID 5044 wrote to memory of 4568	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	96
PID 5044 wrote to memory of 4568	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	96
PID 5044 wrote to memory of 4568	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	96
PID 5044 wrote to memory of 4568	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	96
PID 5044 wrote to memory of 4568	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	96
PID 5044 wrote to memory of 4568	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	96
PID 5044 wrote to memory of 408	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	98
PID 5044 wrote to memory of 408	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	98
PID 5044 wrote to memory of 408	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	98
PID 5044 wrote to memory of 408	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	98
PID 5044 wrote to memory of 408	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	98
PID 5044 wrote to memory of 408	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	98
PID 5044 wrote to memory of 408	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	98
PID 5044 wrote to memory of 408	5044	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	98
PID 4568 wrote to memory of 632	4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	99
PID 4568 wrote to memory of 632	4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	99
PID 4568 wrote to memory of 632	4568	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	99
PID 408 wrote to memory of 4328	408	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	101
PID 408 wrote to memory of 4328	408	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	101
PID 408 wrote to memory of 4328	408	3b41fb9385c0ac13fc08f3fda2098ac0N.exe	101
PID 4328 wrote to memory of 1168	4328	FirstRow.pif	104
PID 4328 wrote to memory of 1168	4328	FirstRow.pif	104
PID 4328 wrote to memory of 1168	4328	FirstRow.pif	104
PID 4328 wrote to memory of 4364	4328	FirstRow.pif	105
PID 4328 wrote to memory of 4364	4328	FirstRow.pif	105
PID 4328 wrote to memory of 4364	4328	FirstRow.pif	105
PID 4328 wrote to memory of 4364	4328	FirstRow.pif	105
PID 4328 wrote to memory of 4364	4328	FirstRow.pif	105
PID 4328 wrote to memory of 4364	4328	FirstRow.pif	105
PID 4328 wrote to memory of 4364	4328	FirstRow.pif	105
PID 4328 wrote to memory of 4364	4328	FirstRow.pif	105
PID 4328 wrote to memory of 924	4328	FirstRow.pif	106
PID 4328 wrote to memory of 924	4328	FirstRow.pif	106
PID 4328 wrote to memory of 924	4328	FirstRow.pif	106
PID 4328 wrote to memory of 924	4328	FirstRow.pif	106
PID 4328 wrote to memory of 924	4328	FirstRow.pif	106
PID 4328 wrote to memory of 924	4328	FirstRow.pif	106
PID 4328 wrote to memory of 924	4328	FirstRow.pif	106
PID 4328 wrote to memory of 924	4328	FirstRow.pif	106
PID 4364 wrote to memory of 4524	4364	FirstRow.pif	108
PID 4364 wrote to memory of 4524	4364	FirstRow.pif	108
PID 4364 wrote to memory of 4524	4364	FirstRow.pif	108
PID 924 wrote to memory of 4552	924	FirstRow.pif	111
PID 924 wrote to memory of 4552	924	FirstRow.pif	111
PID 924 wrote to memory of 4552	924	FirstRow.pif	111
PID 924 wrote to memory of 4552	924	FirstRow.pif	111
PID 924 wrote to memory of 4552	924	FirstRow.pif	111
PID 924 wrote to memory of 5024	924	FirstRow.pif	116
PID 924 wrote to memory of 5024	924	FirstRow.pif	116
PID 924 wrote to memory of 5024	924	FirstRow.pif	116
PID 924 wrote to memory of 5024	924	FirstRow.pif	116
PID 924 wrote to memory of 5024	924	FirstRow.pif	116
PID 4328 wrote to memory of 3864	4328	FirstRow.pif	118
PID 4328 wrote to memory of 3864	4328	FirstRow.pif	118
PID 4328 wrote to memory of 3864	4328	FirstRow.pif	118
PID 4328 wrote to memory of 3864	4328	FirstRow.pif	118
PID 4328 wrote to memory of 3864	4328	FirstRow.pif	118
PID 4328 wrote to memory of 3864	4328	FirstRow.pif	118
PID 4328 wrote to memory of 3864	4328	FirstRow.pif	118

C:\Users\Admin\AppData\Local\Temp\3b41fb9385c0ac13fc08f3fda2098ac0N.exe
"C:\Users\Admin\AppData\Local\Temp\3b41fb9385c0ac13fc08f3fda2098ac0N.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe" /release
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\3b41fb9385c0ac13fc08f3fda2098ac0N.exe
  "C:\Users\Admin\AppData\Local\Temp\3b41fb9385c0ac13fc08f3fda2098ac0N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:632
- C:\Users\Admin\AppData\Local\Temp\3b41fb9385c0ac13fc08f3fda2098ac0N.exe
  "C:\Users\Admin\AppData\Local\Temp\3b41fb9385c0ac13fc08f3fda2098ac0N.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Users\Admin\AppData\Roaming\FirstRow.pif
    "C:\Users\Admin\AppData\Roaming\FirstRow.pif"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\System32\ipconfig.exe" /release
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:1168
  - - C:\Users\Admin\AppData\Roaming\FirstRow.pif
      "C:\Users\Admin\AppData\Roaming\FirstRow.pif"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4364
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /renew
        5⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:4524
  - - C:\Users\Admin\AppData\Roaming\FirstRow.pif
      "C:\Users\Admin\AppData\Roaming\FirstRow.pif"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:924
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:4552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 336
        6⤵
        Program crash
        
        PID:708
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:5024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 336
        6⤵
        Program crash
        
        PID:4888
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:4884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 336
        6⤵
        Program crash
        
        PID:2800
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 336
        6⤵
        Program crash
        
        PID:1784
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:3792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 336
        6⤵
        Program crash
        
        PID:3500
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:2424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 336
        6⤵
        Program crash
        
        PID:4920
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:1168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 340
        6⤵
        Program crash
        
        PID:1080
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:4720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 336
        6⤵
        Program crash
        
        PID:4484
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:2712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 336
        6⤵
        Program crash
        
        PID:2856
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:4868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 336
        6⤵
        Program crash
        
        PID:1592
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 336
        6⤵
        Program crash
        
        PID:1548
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:2892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 336
        6⤵
        Program crash
        
        PID:836
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:1204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 336
        6⤵
        Program crash
        
        PID:2836
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 336
        6⤵
        Program crash
        
        PID:4972
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 504 -s 340
        6⤵
        Program crash
        
        PID:1080
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:4660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 336
        6⤵
        Program crash
        
        PID:1032
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:2464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 336
        6⤵
        Program crash
        
        PID:2976
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:2684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 336
        6⤵
        Program crash
        
        PID:2504
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:1524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 336
        6⤵
        Program crash
        
        PID:3972
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:2116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 336
        6⤵
        Program crash
        
        PID:4820
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:4704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 336
        6⤵
        Program crash
        
        PID:2440
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:4880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 336
        6⤵
        Program crash
        
        PID:2564
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:2012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 336
        6⤵
        Program crash
        
        PID:3852
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 336
        6⤵
        Program crash
        
        PID:3988
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:2964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 336
        6⤵
        Program crash
        
        PID:3168
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:1096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 340
        6⤵
        Program crash
        
        PID:372
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:4168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 336
        6⤵
        Program crash
        
        PID:1548
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        "C:\Windows\system32\bitsadmin.exe"
        5⤵
        
        PID:2728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 336
        6⤵
        Program crash
        
        PID:4328
  - - C:\Users\Admin\AppData\Roaming\FirstRow.pif
      "C:\Users\Admin\AppData\Roaming\FirstRow.pif"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4552 -ip 4552
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5024 -ip 5024
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4884 -ip 4884
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 632 -ip 632
1⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3792 -ip 3792
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2424 -ip 2424
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1168 -ip 1168
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4720 -ip 4720
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2712 -ip 2712
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4868 -ip 4868
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 540 -ip 540
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2892 -ip 2892
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1204 -ip 1204
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 396 -ip 396
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 504 -ip 504
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4660 -ip 4660
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2464 -ip 2464
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2684 -ip 2684
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1524 -ip 1524
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2116 -ip 2116
1⤵
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4704 -ip 4704
1⤵
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4880 -ip 4880
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2012 -ip 2012
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 532 -ip 532
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2964 -ip 2964
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1096 -ip 1096
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4168 -ip 4168
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2728 -ip 2728
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WPIOV.txt

Filesize
142B

MD5
f36ef4e2bfb399e9159d71c0806dc34f

SHA1
9ce20868ec14cabf37d77a1995b1399ebf40681d

SHA256
99a012606942fe84a0ed1b09c60ef765cef48e4ba317b3a71595b300ae531cc2

SHA512
ad7cd152f2b8f04aeee6838ccb2cc10675f289f0e4fd0e6175dace10a062655df1ec2a8d5e80ba65e5d6d0237311c91b0fce54c16e7576dc38b3399abc304b0b

Download Submit
C:\Users\Admin\AppData\Roaming\FirstRow.pif

Filesize
118KB

MD5
f3cd045d74e82f156792e8a6705e5f3d

SHA1
0f3d5649d44e6ad9468a880c83710ab3b3e398fd

SHA256
97db0b544d34d5e46adb07ff7d62f18e3f00d2ce1971bd678c6a680a7f6c136c

SHA512
a20f2aba5909e06c4952e61f32fa1d24fde9f1f25b7065923f02fe0d115c976714ff7a349e325c03c756fae14f744d8a15502695d5a21697bbc553d8414d4ce9

Download Submit
memory/408-24-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/408-40-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/408-36-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/408-22-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/408-27-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/924-87-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3864-74-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3864-100-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3864-77-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3864-72-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3864-75-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4328-41-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4328-76-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4328-47-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4364-192-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4364-84-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-45-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-66-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-237-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-218-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-14-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-44-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-137-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-93-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5044-18-0x0000000003780000-0x0000000003781000-memory.dmp

Filesize
4KB

Download
memory/5044-3-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/5044-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/5044-19-0x0000000003790000-0x0000000003791000-memory.dmp

Filesize
4KB

Download
memory/5044-8-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/5044-10-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/5044-11-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/5044-31-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/5044-5-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/5044-20-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download
memory/5044-17-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/5044-4-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/5044-6-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/5044-9-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download