File name: | DHL Tracking.doc |
Full analysis: | https://app.any.run/tasks/49646e0e-43d5-4f32-aabe-bd15924bc6fe |
Verdict: | Malicious activity |
Threats: | Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS. |
Analysis date: | November 15, 2018, 07:32:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/octet-stream |
File info: | data |
MD5: | 7582C15657E2729858092C48FB92918C |
SHA1: | 09732D9E34100CF7D670D1E5EF89CF1665AB9961 |
SHA256: | BC4270938E74424C9292ED363311672E3B3BA5DAA36A9C43D99A721DE8222E04 |
SSDEEP: | 24576:2g33IMSc/z/HUi22JkQzRHH05ZaUvnjQv:9 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3336 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\DHL Tracking.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2668 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3860 | C:\Users\admin\AppData\Local\Temp\..\..\..\Documents\hosts.exe | C:\Users\admin\Documents\hosts.exe | EQNEDT32.EXE | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2584 | C:\Users\admin\AppData\Local\Temp\..\..\..\Documents\hosts.exe | C:\Users\admin\Documents\hosts.exe | hosts.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2660 | "C:\Users\admin\Documents\hosts.exe" 2 2584 1509125 | C:\Users\admin\Documents\hosts.exe | — | hosts.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3600 | "C:\Users\admin\AppData\Roaming\Install\notepa.exe" | C:\Users\admin\AppData\Roaming\Install\notepa.exe | hosts.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3788 | "C:\Users\admin\Documents\hosts.exe" | C:\Users\admin\Documents\hosts.exe | hosts.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3988 | "C:\Users\admin\AppData\Roaming\Install\notepa.exe" | C:\Users\admin\AppData\Roaming\Install\notepa.exe | notepa.exe | |
User: admin Integrity Level: MEDIUM | ||||
500 | "C:\Users\admin\AppData\Roaming\Install\notepa.exe" 2 3988 1524390 | C:\Users\admin\AppData\Roaming\Install\notepa.exe | — | notepa.exe |
User: admin Integrity Level: MEDIUM | ||||
3252 | "C:\Users\admin\Documents\hosts.exe" | C:\Users\admin\Documents\hosts.exe | — | hosts.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3336 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9C64.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3336 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C47352B4.wmf | — | |
MD5:— | SHA256:— | |||
3336 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\zofkomznwl.qiz | binary | |
MD5:F994CA8D293BE67A010DED7A91D7BE50 | SHA256:DF3F484A68FE54C830E74ECD61909B9D954A7A675711CC47EFBDC6FD614B6E88 | |||
2668 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hosts.lnk | lnk | |
MD5:649766D5F911C93DF853CC4C350B4229 | SHA256:16E8F4F41F3034721D5FAFF6688C45494FACC729B121AD92456966713CFA0C5D | |||
3336 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C7CC2BBF.wmf | binary | |
MD5:BDE0EC8BE92CF5FB64BDC9B8F8076EDE | SHA256:3D13941209F88F8FA0A43468AB9F35E388AF9EF1CE794DE8AB30B8E6438FCC33 | |||
3336 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:DE73CD16372B15BAEB295705CB5C0665 | SHA256:F632D480D71035637003454848418369904B60666AF3749E2E13E876AD4467D0 | |||
2556 | hosts.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\orack.vbs | text | |
MD5:8850322C3CB96BAB1154B5BDEB36F134 | SHA256:D324B941B036A0BD85EDA13DD71FE8CFDD8CCCE8520E38C753EB9419D890FB93 | |||
2220 | hosts.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\orack.vbs | text | |
MD5:8850322C3CB96BAB1154B5BDEB36F134 | SHA256:D324B941B036A0BD85EDA13DD71FE8CFDD8CCCE8520E38C753EB9419D890FB93 | |||
3788 | hosts.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\orack.vbs | text | |
MD5:8850322C3CB96BAB1154B5BDEB36F134 | SHA256:D324B941B036A0BD85EDA13DD71FE8CFDD8CCCE8520E38C753EB9419D890FB93 | |||
3336 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\hosts.exe | binary | |
MD5:D828BF9806F35F27D7441112F8E8926B | SHA256:078A98851060A31ABE43725C887F07CF126E54A04D409D221C2E569DE026DB0B |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3988 | notepa.exe | 104.171.113.233:26116 | trace.ddns.net | Centrilogic, Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
trace.ddns.net |
| malicious |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
3988 | notepa.exe | A Network Trojan was detected | SC SPYWARE Spyware Weecnaw Win32 |
3988 | notepa.exe | A Network Trojan was detected | MALWARE [PTsecurity] Netwire.RAT |
3988 | notepa.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3988 | notepa.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3988 | notepa.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3988 | notepa.exe | A Network Trojan was detected | SC SPYWARE Spyware Weecnaw Win32 |
3988 | notepa.exe | A Network Trojan was detected | MALWARE [PTsecurity] Netwire.RAT |
3988 | notepa.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3988 | notepa.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |
3988 | notepa.exe | A Network Trojan was detected | ET TROJAN Possible Netwire RAT Client HeartBeat C2 |