analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | file |
| Full analysis: | https://app.any.run/tasks/aaab3e89-2a2a-4cd5-86e1-7c24b55ce8eb |
| Verdict: | Malicious activity |
| Threats: | Netwire is an advanced RAT — it is a malware that takes control of infected PCs and allows its operators to perform various actions. Unlike many RATs, this one can target every major operating system, including Windows, Linux, and MacOS. |
| Analysis date: | October 14, 2019, 13:49:11 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | E9CECDB7171B5C3AC9A45AD2C9A8245F |
| SHA1: | 57AA8CB91200C06D92A10DE8EF41B9B68C3822E5 |
| SHA256: | DA80A512664420763FF13B739E5E31B3D4D5DDE1C7EFB80769079EA2D2B864CC |
| SSDEEP: | 6144:FVj2Fjplll7NNIj/+r6VIIb3OjPIFVNJyiiC9OQnUc+fYmvEERgx4pFjPIfPOPMM:FhALl7H8+QIIb3cyhOCUcfmvhpJoPOPp |
MALICIOUS
Application was dropped or rewritten from another process
- REMITTANCE COPY FOR OCT.exe (PID: 2620)
- REMITTANCE COPY FOR OCT.exe (PID: 392)
- Host.exe (PID: 3976)
- Host.exe (PID: 2840)
Changes the autorun value in the registry
- Host.exe (PID: 2840)
NETWIRE was detected
- Host.exe (PID: 2840)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 992)
- REMITTANCE COPY FOR OCT.exe (PID: 392)
Creates files in the user directory
- REMITTANCE COPY FOR OCT.exe (PID: 392)
Application launched itself
- REMITTANCE COPY FOR OCT.exe (PID: 2620)
- Host.exe (PID: 3976)
Starts itself from another location
- REMITTANCE COPY FOR OCT.exe (PID: 392)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
Total processes
38
Monitored processes
5
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 992 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\file.7z" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
| 2620 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa992.48263\REMITTANCE COPY FOR OCT.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa992.48263\REMITTANCE COPY FOR OCT.exe | — | WinRAR.exe |
User: admin Company: Mccaysladykilling4 Integrity Level: MEDIUM Exit code: 0 Version: 1.01.0004 | ||||
| 392 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa992.48263\REMITTANCE COPY FOR OCT.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa992.48263\REMITTANCE COPY FOR OCT.exe | REMITTANCE COPY FOR OCT.exe | |
User: admin Company: Mccaysladykilling4 Integrity Level: MEDIUM Exit code: 0 Version: 1.01.0004 | ||||
| 3976 | "C:\Users\admin\AppData\Roaming\Install\Host.exe" | C:\Users\admin\AppData\Roaming\Install\Host.exe | — | REMITTANCE COPY FOR OCT.exe |
User: admin Company: Mccaysladykilling4 Integrity Level: MEDIUM Exit code: 0 Version: 1.01.0004 | ||||
| 2840 | "C:\Users\admin\AppData\Roaming\Install\Host.exe" | C:\Users\admin\AppData\Roaming\Install\Host.exe | Host.exe | |
User: admin Company: Mccaysladykilling4 Integrity Level: MEDIUM Version: 1.01.0004 | ||||
Total events
786
Read events
766
Write events
20
Delete events
0
Modification events
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\file.7z | |||
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (992) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 992 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa992.48263\REMITTANCE COPY FOR OCT.exe | executable | |
MD5:BDBDB1EA562EEB74D1D4E9B9A8C0595D | SHA256:D9BFF1AE2F4859AE2521F0869F7E9863B52EA1D81E537BB0CA003BF730696FA7 | |||
| 392 | REMITTANCE COPY FOR OCT.exe | C:\Users\admin\AppData\Roaming\Install\Host.exe | executable | |
MD5:BDBDB1EA562EEB74D1D4E9B9A8C0595D | SHA256:D9BFF1AE2F4859AE2521F0869F7E9863B52EA1D81E537BB0CA003BF730696FA7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
3
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 79.134.225.76:3369 | fucktoto.duckdns.org | Andreas Fink trading as Fink Telecom Services | CH | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
fucktoto.duckdns.org |
| malicious |
dns.msftncsi.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |