Malware Analysis Report

2025-01-18 16:34

Sample ID 241125-jzaf1ssrdl
Target 7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe
SHA256 7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d
Tags
netwire botnet discovery persistence rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d

Threat Level: Known bad

The file 7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe was found to be: Known bad.

Malicious Activity Summary

netwire botnet discovery persistence rat stealer

Modifies WinLogon for persistence

Netwire

NetWire RAT payload

Netwire family

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Program crash

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-25 08:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-25 08:05

Reported

2024-11-25 08:08

Platform

win7-20241023-en

Max time kernel

145s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe N/A

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\notepad .exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2220 set thread context of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\notepad .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2220 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2192 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2192 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2192 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2220 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 2220 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 2220 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 2220 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 2220 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 2220 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 2220 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 2220 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 2220 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 2220 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 2220 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 2220 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 2220 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 2360 wrote to memory of 2924 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2360 wrote to memory of 2924 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2360 wrote to memory of 2924 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2360 wrote to memory of 2924 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\notepad .exe C:\Windows\SysWOW64\WerFault.exe
PID 2884 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\notepad .exe C:\Windows\SysWOW64\WerFault.exe
PID 2884 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\notepad .exe C:\Windows\SysWOW64\WerFault.exe
PID 2884 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\notepad .exe C:\Windows\SysWOW64\WerFault.exe
PID 2220 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 2220 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 1708 wrote to memory of 1340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1708 wrote to memory of 1340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1708 wrote to memory of 1340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1708 wrote to memory of 1340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe

"C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\\mata.bat

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

C:\Users\Admin\AppData\Local\Temp\notepad .exe

"C:\Users\Admin\AppData\Local\Temp\notepad .exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 116

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\stres.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout /t 300

Network

Country Destination Domain Proto
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp

Files

memory/2220-0-0x0000000074D41000-0x0000000074D42000-memory.dmp

memory/2220-1-0x0000000074D40000-0x00000000752EB000-memory.dmp

memory/2220-2-0x0000000074D40000-0x00000000752EB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mata.bat

MD5 58c538a6ae20a3c6031217903cdf8e5d
SHA1 399fd50eadf4945b665877facfc4f53d16e18b1e
SHA256 6bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53
SHA512 c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359

\Users\Admin\AppData\Local\Temp\tmp.exe

MD5 0a5984405864c6f61bf0e4d5b7fbe8ed
SHA1 083051131e44a5d7a7dbba7cbbbc195849193042
SHA256 0b182398ee3a3b27e70bacce39a8dbd9faeec94ca2d82a12a644efecf9d426bd
SHA512 892028e7f2a128fa0706118bda10d68b415ed328cd28c2fb70c004cebe5d418259e5b28ac6d77aade568a8668db8065696d908d94a2f221d9e8b4d268c0b2ebd

memory/2884-32-0x0000000000400000-0x0000000000417000-memory.dmp

memory/2884-33-0x0000000000400000-0x0000000000417000-memory.dmp

memory/2884-31-0x0000000000400000-0x0000000000417000-memory.dmp

memory/2884-30-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

\Users\Admin\AppData\Local\Temp\notepad .exe

MD5 278edbd499374bf73621f8c1f969d894
SHA1 a81170af14747781c5f5f51bb1215893136f0bc0
SHA256 c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA512 93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

memory/2884-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mata2.bat

MD5 095b2908ae8b2e0e3704c0163f26e283
SHA1 3429b6c1421d448c98c1da9625badcea2484a521
SHA256 22b182644ab28f5e9e17b5a03ba404d09b02da367146b80484584adc842a3ed1
SHA512 e22e379b4f0d8e11fa7c29c3297a3e24a533fb08895d18e9bb27e8cab84da1dd52ff437aca90c5c32a9bdb578b3c1bfb3ff42d3bc2c5951ffeb5941c8286c731

C:\Users\Admin\AppData\Local\Temp\rundll11-.txt

MD5 727d339d4485e05c1cc8764c854eddbf
SHA1 c230be06684e4f27dfaa066c0d3f631232770bb6
SHA256 7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d
SHA512 f1bd31e1963bc36468f0fde5c50de555e6dba5361585017e9720e249cc8133fdd72a7274928cb7ba8564d0d42d508a008ae0ee220ea9773af98f7f7b4d9c3925

memory/2220-39-0x0000000074D40000-0x00000000752EB000-memory.dmp

memory/2884-40-0x0000000000400000-0x0000000000417000-memory.dmp

memory/648-41-0x0000000000400000-0x0000000000417000-memory.dmp

memory/2884-46-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\stres.bat

MD5 fc10f5325d4bf4be8eaac50c0a463469
SHA1 54d4daf129d17abf8284835017865f99c70ffe22
SHA256 acf2946adf8e613c5f2d776863f844b9572fc580eb4d9324f285d1bb3844e70e
SHA512 ae3ba84843312be74fda36615bd476f7b6aec5223cc0dbb183d42a57c27a8d2a6545f5273866ded6d3e3c31ef640724c74c0f47992c1c825f6f2e56ab5160490

memory/2220-64-0x0000000074D40000-0x00000000752EB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-25 08:05

Reported

2024-11-25 08:08

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe N/A

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\notepad .exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4792 set thread context of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\notepad .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4792 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 4792 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 4792 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 4432 wrote to memory of 3456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 4432 wrote to memory of 3456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 4432 wrote to memory of 3456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 3456 wrote to memory of 1072 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 3456 wrote to memory of 1072 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 3456 wrote to memory of 1072 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 4792 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 4792 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 4792 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\tmp.exe
PID 4792 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 4792 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 4792 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 4792 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 4792 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 4792 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 4792 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 4792 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 4792 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Users\Admin\AppData\Local\Temp\notepad .exe
PID 4792 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 4792 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 4792 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe C:\Windows\SysWOW64\cmd.exe
PID 2612 wrote to memory of 3004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2612 wrote to memory of 3004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2612 wrote to memory of 3004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe

"C:\Users\Admin\AppData\Local\Temp\7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\mata.bat

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat

C:\Users\Admin\AppData\Local\Temp\tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "

C:\Users\Admin\AppData\Local\Temp\notepad .exe

"C:\Users\Admin\AppData\Local\Temp\notepad .exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2628 -ip 2628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 348

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\stres.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout /t 300

Network

Country Destination Domain Proto
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp
US 8.8.8.8:53 nightwolf.dyndns-ip.com udp

Files

memory/4792-0-0x00000000754D2000-0x00000000754D3000-memory.dmp

memory/4792-1-0x00000000754D0000-0x0000000075A81000-memory.dmp

memory/4792-2-0x00000000754D0000-0x0000000075A81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mata.bat

MD5 58c538a6ae20a3c6031217903cdf8e5d
SHA1 399fd50eadf4945b665877facfc4f53d16e18b1e
SHA256 6bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53
SHA512 c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359

C:\Users\Admin\AppData\Local\Temp\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Users\Admin\AppData\Local\Temp\mata2.bat

MD5 095b2908ae8b2e0e3704c0163f26e283
SHA1 3429b6c1421d448c98c1da9625badcea2484a521
SHA256 22b182644ab28f5e9e17b5a03ba404d09b02da367146b80484584adc842a3ed1
SHA512 e22e379b4f0d8e11fa7c29c3297a3e24a533fb08895d18e9bb27e8cab84da1dd52ff437aca90c5c32a9bdb578b3c1bfb3ff42d3bc2c5951ffeb5941c8286c731

C:\Users\Admin\AppData\Local\Temp\tmp.exe

MD5 0a5984405864c6f61bf0e4d5b7fbe8ed
SHA1 083051131e44a5d7a7dbba7cbbbc195849193042
SHA256 0b182398ee3a3b27e70bacce39a8dbd9faeec94ca2d82a12a644efecf9d426bd
SHA512 892028e7f2a128fa0706118bda10d68b415ed328cd28c2fb70c004cebe5d418259e5b28ac6d77aade568a8668db8065696d908d94a2f221d9e8b4d268c0b2ebd

C:\Users\Admin\AppData\Local\Temp\rundll11-.txt

MD5 727d339d4485e05c1cc8764c854eddbf
SHA1 c230be06684e4f27dfaa066c0d3f631232770bb6
SHA256 7649b0d5eac5d15692826bcaff2ac11264c87e3aea26ff89e19e280ed3a5806d
SHA512 f1bd31e1963bc36468f0fde5c50de555e6dba5361585017e9720e249cc8133fdd72a7274928cb7ba8564d0d42d508a008ae0ee220ea9773af98f7f7b4d9c3925

memory/4792-26-0x00000000754D2000-0x00000000754D3000-memory.dmp

memory/4792-27-0x00000000754D0000-0x0000000075A81000-memory.dmp

memory/2628-28-0x0000000000400000-0x0000000000417000-memory.dmp

memory/3704-29-0x0000000000400000-0x0000000000417000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\notepad .exe

MD5 a64daca3cfbcd039df3ec29d3eddd001
SHA1 eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256 403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512 b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

memory/2628-34-0x0000000000400000-0x0000000000417000-memory.dmp

memory/4792-43-0x00000000754D0000-0x0000000075A81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\stres.bat

MD5 fc10f5325d4bf4be8eaac50c0a463469
SHA1 54d4daf129d17abf8284835017865f99c70ffe22
SHA256 acf2946adf8e613c5f2d776863f844b9572fc580eb4d9324f285d1bb3844e70e
SHA512 ae3ba84843312be74fda36615bd476f7b6aec5223cc0dbb183d42a57c27a8d2a6545f5273866ded6d3e3c31ef640724c74c0f47992c1c825f6f2e56ab5160490