Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 02:17
Static task
static1
Behavioral task
behavioral1
Sample
a6b3b195fc729456c47573cc58f7b420.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a6b3b195fc729456c47573cc58f7b420.exe
Resource
win10v2004-20240611-en
General
-
Target
a6b3b195fc729456c47573cc58f7b420.exe
-
Size
160KB
-
MD5
a6b3b195fc729456c47573cc58f7b420
-
SHA1
1a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
-
SHA256
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
-
SHA512
eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
SSDEEP
3072:aKZFby2LWGwwgtkpmOgUkimSGX1sz3+l3dfd1:Dby2yGwwgtQmOgUkiDGX1sL+lNl
Malware Config
Extracted
netwire
rop-s.ru:3360
-
activex_autorun
true
-
activex_key
{12VT1G0W-4N37-8VXY-40Y3-HP5QCF1KT4P3}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\microsofts\iexplore.exe
-
keylogger_dir
%AppData%\microsofts\Logs\
-
lock_executable
false
-
mutex
fortune
-
offline_keylogger
true
-
password
fortune
-
registry_autorun
true
-
startup_name
iexplore
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/724-9-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/724-20-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/2016-14-0x0000000000660000-0x0000000000760000-memory.dmp netwire behavioral2/memory/724-12-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/4684-42-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12VT1G0W-4N37-8VXY-40Y3-HP5QCF1KT4P3} iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12VT1G0W-4N37-8VXY-40Y3-HP5QCF1KT4P3}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\iexplore.exe\"" iexplore.exe -
Executes dropped EXE 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 652 iexplore.exe 4684 iexplore.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplore = "C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\iexplore.exe" iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a6b3b195fc729456c47573cc58f7b420.exeiexplore.exedescription pid process target process PID 2016 set thread context of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 652 set thread context of 4684 652 iexplore.exe iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a6b3b195fc729456c47573cc58f7b420.exeiexplore.exepid process 2016 a6b3b195fc729456c47573cc58f7b420.exe 652 iexplore.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
a6b3b195fc729456c47573cc58f7b420.exea6b3b195fc729456c47573cc58f7b420.exeiexplore.exedescription pid process target process PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe a6b3b195fc729456c47573cc58f7b420.exe PID 724 wrote to memory of 652 724 a6b3b195fc729456c47573cc58f7b420.exe iexplore.exe PID 724 wrote to memory of 652 724 a6b3b195fc729456c47573cc58f7b420.exe iexplore.exe PID 724 wrote to memory of 652 724 a6b3b195fc729456c47573cc58f7b420.exe iexplore.exe PID 652 wrote to memory of 4684 652 iexplore.exe iexplore.exe PID 652 wrote to memory of 4684 652 iexplore.exe iexplore.exe PID 652 wrote to memory of 4684 652 iexplore.exe iexplore.exe PID 652 wrote to memory of 4684 652 iexplore.exe iexplore.exe PID 652 wrote to memory of 4684 652 iexplore.exe iexplore.exe PID 652 wrote to memory of 4684 652 iexplore.exe iexplore.exe PID 652 wrote to memory of 4684 652 iexplore.exe iexplore.exe PID 652 wrote to memory of 4684 652 iexplore.exe iexplore.exe PID 652 wrote to memory of 4684 652 iexplore.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6b3b195fc729456c47573cc58f7b420.exe"C:\Users\Admin\AppData\Local\Temp\a6b3b195fc729456c47573cc58f7b420.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a6b3b195fc729456c47573cc58f7b420.exe"C:\Users\Admin\AppData\Local\Temp\a6b3b195fc729456c47573cc58f7b420.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exeFilesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
memory/652-33-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/652-38-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/724-9-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/724-20-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/724-12-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2016-15-0x0000000000660000-0x0000000000760000-memory.dmpFilesize
1024KB
-
memory/2016-19-0x0000000000660000-0x0000000000760000-memory.dmpFilesize
1024KB
-
memory/2016-18-0x0000000000660000-0x0000000000760000-memory.dmpFilesize
1024KB
-
memory/2016-14-0x0000000000660000-0x0000000000760000-memory.dmpFilesize
1024KB
-
memory/2016-43-0x0000000000660000-0x0000000000760000-memory.dmpFilesize
1024KB
-
memory/4684-42-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB