Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09/11/2020, 19:43

General

  • Target
    Quotation 11052020.exe
  • Size 1009KB
  • Sample201109-89rax47d5x
  • SHA256 96a55e86b6b4d7ddfe80b096de08f57f7e8c417b2cb7dcf65a0c83aa32ed29dc
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • NetWire RAT payload 23 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 5326 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of WriteProcessMemory 177 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
    "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          PID:3824
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe" 2 3824 259275250
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2928
    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 2376 259274500
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
          "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
          4⤵
            PID:4092
          • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
            "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 4092 259275484
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:196
            • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
              "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2832
              • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                6⤵
                  PID:2320
                • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                  "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 2320 259283812
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3928
                  • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                    "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                    7⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of WriteProcessMemory
                    PID:1336
                    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                      8⤵
                        PID:2472
                      • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                        "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 2472 259292140
                        8⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3104
                        • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                          "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                          9⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of WriteProcessMemory
                          PID:3816
                          • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                            "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                            10⤵
                              PID:3404
                            • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                              "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 3404 259300453
                              10⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4048
                              • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                11⤵
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of WriteProcessMemory
                                PID:3492
                                • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                  12⤵
                                    PID:1404
                                  • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1404 259308734
                                    12⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3820
                                    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                      13⤵
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of WriteProcessMemory
                                      PID:3844
                                      • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                        14⤵
                                          PID:2136
                                        • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 2136 259317015
                                          14⤵
                                            PID:1620
                                            • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                              15⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: MapViewOfSection
                                              PID:1908
                                              • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                16⤵
                                                  PID:3532
                                                • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 3532 259325281
                                                  16⤵
                                                    PID:2280
                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                      17⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious behavior: MapViewOfSection
                                                      PID:4052
                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                        18⤵
                                                          PID:1592
                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1592 259333562
                                                          18⤵
                                                            PID:3984
                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                              19⤵
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious behavior: MapViewOfSection
                                                              PID:3484
                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                20⤵
                                                                  PID:632
                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 632 259341890
                                                                  20⤵
                                                                    PID:584
                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                      21⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious behavior: MapViewOfSection
                                                                      PID:2764
                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                        22⤵
                                                                          PID:3564
                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 3564 259350187
                                                                          22⤵
                                                                            PID:8
                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                              23⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              PID:2204
                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                24⤵
                                                                                  PID:2740
                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 2740 259358515
                                                                                  24⤵
                                                                                    PID:2364
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                      25⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      PID:4036
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                        26⤵
                                                                                          PID:208
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 208 259366781
                                                                                          26⤵
                                                                                            PID:4088
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                              27⤵
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                              PID:1900
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                28⤵
                                                                                                  PID:3612
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 3612 259375078
                                                                                                  28⤵
                                                                                                    PID:752
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                      29⤵
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                      PID:3452
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                        30⤵
                                                                                                          PID:3248
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 3248 259383390
                                                                                                          30⤵
                                                                                                            PID:2888
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                              31⤵
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                              PID:2772
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                                32⤵
                                                                                                                  PID:1188
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1188 259391671
                                                                                                                  32⤵
                                                                                                                    PID:3568
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                                      33⤵
                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                      PID:3260
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                                        34⤵
                                                                                                                          PID:3608
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 3608 259399968
                                                                                                                          34⤵
                                                                                                                            PID:1452
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                                              35⤵
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                              PID:492
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                                                36⤵
                                                                                                                                  PID:3268
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 3268 259408265
                                                                                                                                  36⤵
                                                                                                                                    PID:2096
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                                                      37⤵
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                      PID:416
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"
                                                                                                                                        38⤵
                                                                                                                                          PID:2748
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 2748 259416531
                                                                                                                                          38⤵
                                                                                                                                            PID:3572

                                                                Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      memory/2376-3-0x0000000000400000-0x0000000000433000-memory.dmp

                                                                      memory/2376-0-0x0000000000400000-0x0000000000433000-memory.dmp

                                                                      memory/3824-12-0x0000000000400000-0x0000000000433000-memory.dmp