netwire | 4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
Size

178KB
MD5

a012533b4e4ffe2ec1fba8af4d64f7d0
SHA1

6addd503fa50ab9b551ff26cfd44f65d0348e898
SHA256

4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40
SHA512

f588e81bf477c001995d44d7d17eedca3a7392eb43072679e06b1440f8c9cb9dd1ecf597e536ccf2975fcf9f3d7c481306b3a018194815e6f87bdfd211604301
SSDEEP

3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwe:I7VzxYnWI6agAalr4UrPp8WStPQu28Z

Score

10^/10

netwire botnet discovery evasion persistence rat stealer

Malware Config

Extracted

Family

netwire

wallou.publicvm.com:3365

mediafire.duckdns.org:3365

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
DLL2
keylogger_dir
%AppData%\System\
lock_executable
true
mutex
KgpcGWmM
offline_keylogger
true
password
Reborn
registry_autorun
false
use_mutex
true

Signatures

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1780-15-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1780-17-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/1780-12-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2848	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
1780	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Loads dropped DLL 1 IoCs

pid	Process
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 1780	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	75

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1112	ping.exe
1892	ping.exe
2364	ping.exe
3036	ping.exe
2684	ping.exe
1304	ping.exe
2128	ping.exe
2888	ping.exe
2600	ping.exe
2348	ping.exe
1004	ping.exe
2268	ping.exe
2752	ping.exe
2956	ping.exe
1144	ping.exe
2148	ping.exe
1800	ping.exe
2740	ping.exe
2628	ping.exe
2024	ping.exe

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

pid	Process
2600	ping.exe
1304	ping.exe
2128	ping.exe
2364	ping.exe
2684	ping.exe
2740	ping.exe
1112	ping.exe
2024	ping.exe
2956	ping.exe
1144	ping.exe
1800	ping.exe
1004	ping.exe
2148	ping.exe
3036	ping.exe
2752	ping.exe
2888	ping.exe
2628	ping.exe
2348	ping.exe
1892	ping.exe
2268	ping.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 3036	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	30
PID 2032 wrote to memory of 3036	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	30
PID 2032 wrote to memory of 3036	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	30
PID 2032 wrote to memory of 3036	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	30
PID 2032 wrote to memory of 2684	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	32
PID 2032 wrote to memory of 2684	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	32
PID 2032 wrote to memory of 2684	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	32
PID 2032 wrote to memory of 2684	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	32
PID 2032 wrote to memory of 2740	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	35
PID 2032 wrote to memory of 2740	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	35
PID 2032 wrote to memory of 2740	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	35
PID 2032 wrote to memory of 2740	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	35
PID 2032 wrote to memory of 2752	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	37
PID 2032 wrote to memory of 2752	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	37
PID 2032 wrote to memory of 2752	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	37
PID 2032 wrote to memory of 2752	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	37
PID 2032 wrote to memory of 2888	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	39
PID 2032 wrote to memory of 2888	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	39
PID 2032 wrote to memory of 2888	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	39
PID 2032 wrote to memory of 2888	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	39
PID 2032 wrote to memory of 2628	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	41
PID 2032 wrote to memory of 2628	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	41
PID 2032 wrote to memory of 2628	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	41
PID 2032 wrote to memory of 2628	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	41
PID 2032 wrote to memory of 2600	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	43
PID 2032 wrote to memory of 2600	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	43
PID 2032 wrote to memory of 2600	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	43
PID 2032 wrote to memory of 2600	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	43
PID 2032 wrote to memory of 1304	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	45
PID 2032 wrote to memory of 1304	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	45
PID 2032 wrote to memory of 1304	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	45
PID 2032 wrote to memory of 1304	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	45
PID 2032 wrote to memory of 2348	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	47
PID 2032 wrote to memory of 2348	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	47
PID 2032 wrote to memory of 2348	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	47
PID 2032 wrote to memory of 2348	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	47
PID 2032 wrote to memory of 1112	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	49
PID 2032 wrote to memory of 1112	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	49
PID 2032 wrote to memory of 1112	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	49
PID 2032 wrote to memory of 1112	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	49
PID 2032 wrote to memory of 2848	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	51
PID 2032 wrote to memory of 2848	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	51
PID 2032 wrote to memory of 2848	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	51
PID 2032 wrote to memory of 2848	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	51
PID 2032 wrote to memory of 1976	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	53
PID 2032 wrote to memory of 1976	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	53
PID 2032 wrote to memory of 1976	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	53
PID 2032 wrote to memory of 1976	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	53
PID 2032 wrote to memory of 2128	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	54
PID 2032 wrote to memory of 2128	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	54
PID 2032 wrote to memory of 2128	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	54
PID 2032 wrote to memory of 2128	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	54
PID 2032 wrote to memory of 2024	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	57
PID 2032 wrote to memory of 2024	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	57
PID 2032 wrote to memory of 2024	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	57
PID 2032 wrote to memory of 2024	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	57
PID 2032 wrote to memory of 1892	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	59
PID 2032 wrote to memory of 1892	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	59
PID 2032 wrote to memory of 1892	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	59
PID 2032 wrote to memory of 1892	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	59
PID 2032 wrote to memory of 2956	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	61
PID 2032 wrote to memory of 2956	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	61
PID 2032 wrote to memory of 2956	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	61
PID 2032 wrote to memory of 2956	2032	4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe	61

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2848	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
"C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3036
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2684
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2740
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2752
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2888
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2628
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2600
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1304
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2348
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1112
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2848
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1976
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2128
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2024
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1892
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2956
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2148
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2364
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1144
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1800
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1004
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2268
- C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe
  "C:\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1780
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1488
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1056
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1324
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2520
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2748
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1916
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2632
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2464
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2836
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2872
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2424
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1208
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1408
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IntelCore\IntelCore.exe

Filesize
178KB

MD5
e2a26ca2c5ff6bf68bdb7cbb893464d7

SHA1
8f2e09e4c14c4022a92baefe3921dd0d24e72e7e

SHA256
a70e01433b7356079010f7efa4224adfee46f59abd2a1115047a760daafb3471

SHA512
c3c5e0d0de35847fca3414818f2b01c496bf8a579e3155b3fe07ea3c9f18b3607dbb1065091787704c784157d22b96f5d9e85d309d95fe1113c3f87255ba2c3f

Download Submit
\Users\Admin\AppData\Local\Temp\4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N.exe

Filesize
178KB

MD5
a012533b4e4ffe2ec1fba8af4d64f7d0

SHA1
6addd503fa50ab9b551ff26cfd44f65d0348e898

SHA256
4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40

SHA512
f588e81bf477c001995d44d7d17eedca3a7392eb43072679e06b1440f8c9cb9dd1ecf597e536ccf2975fcf9f3d7c481306b3a018194815e6f87bdfd211604301

Download Submit
memory/1780-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1780-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1780-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1780-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1780-17-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1780-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1780-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2032-3-0x0000000074B70000-0x000000007511B000-memory.dmp

Filesize
5.7MB

Download
memory/2032-2-0x0000000074B70000-0x000000007511B000-memory.dmp

Filesize
5.7MB

Download
memory/2032-0-0x0000000074B71000-0x0000000074B72000-memory.dmp

Filesize
4KB

Download
memory/2032-1-0x0000000074B70000-0x000000007511B000-memory.dmp

Filesize
5.7MB

Download