Overview

overview

10

Static

static

15-08-2020...IP.exe

windows7_x64

10

15-08-2020...IP.exe

windows10_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    15/08/2020, 17:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    15-08-2020 - SOFT COPY_PAYMENT SLIP.exe
  • Size 234KB
  • Sample200815-ac3k2389xs
  • SHA256 b6f5a289ab47b790c1bc57a5a3b35871fc968da66ebb3fdd7669de18c2ba3dd5
  • MD5 SHA1 SHA512
Score
10/10
ratbotnetstealernetwire

Malware Config

Signatures

  • NetWire RAT payload 5 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15-08-2020 - SOFT COPY_PAYMENT SLIP.exe
    "C:\Users\Admin\AppData\Local\Temp\15-08-2020 - SOFT COPY_PAYMENT SLIP.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Executes dropped EXE
      PID:780
    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
      2⤵
      • Executes dropped EXE
      PID:424
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\word.exe.lnk" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\word.exe.lnk" /f
        3⤵
          PID:1268
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\word.exe:Zone.Identifier
        2⤵
        • NTFS ADS
        PID:1408
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderN\word.exe.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 300
          3⤵
          • Delays execution with timeout.exe
          PID:2020

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/424-8-0x0000000000400000-0x0000000000433000-memory.dmp
          Download

          memory/424-11-0x0000000000400000-0x0000000000433000-memory.dmp
          Download

          memory/2584-7-0x0000000006330000-0x0000000006331000-memory.dmp
          Download

          memory/2584-0-0x0000000073940000-0x000000007402E000-memory.dmp
          Download

          memory/2584-3-0x0000000005290000-0x0000000005291000-memory.dmp
          Download

          memory/2584-1-0x0000000000A60000-0x0000000000A61000-memory.dmp
          Download