Analysis
-
max time kernel
40s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hd.sentinel.pro.4.x-5.x-Patch.exe
Resource
win7-20240708-en
windows7-x64
14 signatures
150 seconds
General
-
Target
hd.sentinel.pro.4.x-5.x-Patch.exe
-
Size
356KB
-
MD5
05a20a1a555d11e3981867f46b64e696
-
SHA1
a69dbc6ea5176d692d700b2fb69b8b21a9176208
-
SHA256
08b27ef5cca3892b6ed39bb59985c9e6295b4cdc2d89a52dd65040f0f995e3f2
-
SHA512
a68b3319d728e980f41771c4a2d973ba34c129f49b4f3e3ac8bff1f18ac5732e60b48f532d61939d4a4cca79f112a6248dd9f4421503479ce109fba7d7841e99
-
SSDEEP
6144:TuxXeDoNSbUkmUGBfwX9SKtVzK4ZjgAlvNarXdoadhg:TuODoNuhGB4oKtVzK4ZUAlVaDeaTg
Malware Config
Extracted
Family
netwire
C2
haija.mine.nu:1616
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 6 IoCs
resource yara_rule behavioral1/memory/320-28-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/320-35-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/320-32-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/320-30-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/320-36-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/320-38-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
pid Process 2912 File.exe -
Loads dropped DLL 4 IoCs
pid Process 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 2912 File.exe 2912 File.exe 2768 hd.sentinel.pro.4.x-5.x-Patch.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2768 set thread context of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Data\chrom.exe:Zone.Identifier cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language File.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hd.sentinel.pro.4.x-5.x-Patch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hd.sentinel.pro.4.x-5.x-Patch.exe -
Modifies registry class 31 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff File.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" File.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU File.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell File.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 File.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" File.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg File.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" File.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" File.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff File.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff File.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} File.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" File.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings File.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" File.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg File.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 File.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff File.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff File.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" File.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Data\chrom.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 2768 hd.sentinel.pro.4.x-5.x-Patch.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2768 hd.sentinel.pro.4.x-5.x-Patch.exe Token: 33 2768 hd.sentinel.pro.4.x-5.x-Patch.exe Token: SeIncBasePriorityPrivilege 2768 hd.sentinel.pro.4.x-5.x-Patch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2912 File.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2912 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 30 PID 2768 wrote to memory of 2912 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 30 PID 2768 wrote to memory of 2912 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 30 PID 2768 wrote to memory of 2912 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 30 PID 2768 wrote to memory of 2912 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 30 PID 2768 wrote to memory of 2912 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 30 PID 2768 wrote to memory of 2912 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 30 PID 2768 wrote to memory of 1808 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 31 PID 2768 wrote to memory of 1808 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 31 PID 2768 wrote to memory of 1808 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 31 PID 2768 wrote to memory of 1808 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 31 PID 2768 wrote to memory of 1808 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 31 PID 2768 wrote to memory of 1808 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 31 PID 2768 wrote to memory of 1808 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 31 PID 2768 wrote to memory of 2612 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 33 PID 2768 wrote to memory of 2612 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 33 PID 2768 wrote to memory of 2612 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 33 PID 2768 wrote to memory of 2612 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 33 PID 2768 wrote to memory of 2612 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 33 PID 2768 wrote to memory of 2612 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 33 PID 2768 wrote to memory of 2612 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 33 PID 2612 wrote to memory of 2680 2612 cmd.exe 35 PID 2612 wrote to memory of 2680 2612 cmd.exe 35 PID 2612 wrote to memory of 2680 2612 cmd.exe 35 PID 2612 wrote to memory of 2680 2612 cmd.exe 35 PID 2612 wrote to memory of 2680 2612 cmd.exe 35 PID 2612 wrote to memory of 2680 2612 cmd.exe 35 PID 2612 wrote to memory of 2680 2612 cmd.exe 35 PID 2768 wrote to memory of 2320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 36 PID 2768 wrote to memory of 2320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 36 PID 2768 wrote to memory of 2320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 36 PID 2768 wrote to memory of 2320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 36 PID 2768 wrote to memory of 2320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 36 PID 2768 wrote to memory of 2320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 36 PID 2768 wrote to memory of 2320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 36 PID 2768 wrote to memory of 2284 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 38 PID 2768 wrote to memory of 2284 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 38 PID 2768 wrote to memory of 2284 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 38 PID 2768 wrote to memory of 2284 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 38 PID 2768 wrote to memory of 2284 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 38 PID 2768 wrote to memory of 2284 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 38 PID 2768 wrote to memory of 2284 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 38 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40 PID 2768 wrote to memory of 320 2768 hd.sentinel.pro.4.x-5.x-Patch.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-Patch.exe"C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-Patch.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2912
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/hd.sentinel.pro.4.x-5.x-Patch.exe" "%appdata%\Data\chrom.exe" /Y2⤵
- System Location Discovery: System Language Discovery
PID:1808
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Data\chrom.exe.lnk" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Data\chrom.exe.lnk" /f3⤵
- System Location Discovery: System Language Discovery
PID:2680
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Data\chrom.exe:Zone.Identifier2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2320
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "%appdata%\Data\chrom.exe.jpg" chrom.exe2⤵
- System Location Discovery: System Language Discovery
PID:2284
-
-
C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-Patch.exe"C:/Users/Admin/AppData/Local/Temp/hd.sentinel.pro.4.x-5.x-Patch.exe"2⤵
- System Location Discovery: System Language Discovery
PID:320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
356KB
MD505a20a1a555d11e3981867f46b64e696
SHA1a69dbc6ea5176d692d700b2fb69b8b21a9176208
SHA25608b27ef5cca3892b6ed39bb59985c9e6295b4cdc2d89a52dd65040f0f995e3f2
SHA512a68b3319d728e980f41771c4a2d973ba34c129f49b4f3e3ac8bff1f18ac5732e60b48f532d61939d4a4cca79f112a6248dd9f4421503479ce109fba7d7841e99
-
Filesize
85KB
MD557824abbb9afe394c8a17a410e60c6fd
SHA1cdb3fe63c22e7d93d4a47bdb966b09f1b478f19f
SHA256becb4e1eaa4fbd915241f1138e2ed7b9833dc1cf66d6da25f9fac1a3e317c3ee
SHA5128b4e82437d6a30e73b65d0abc41b68d8420454622efd43d8d874ecee7a9251f36555d4c35dd13f886250948df1b9606ee61d0bcb2c8abb748b316dadff539c3d