Analysis

  • max time kernel
    72s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-01-2021 18:13

General

  • Target

    OrderNo-202000125.exe

  • Size

    836KB

  • MD5

    8768f782c4b33518acab30685d3106dc

  • SHA1

    41fbeffbc5853d803a64b3a00b2b95fce72d0bbc

  • SHA256

    cb9713e99535b6589f62d352c0a22488ae19d4b02df7f33e3fc052e9c8414481

  • SHA512

    6e654f085f7047638d2720e9b58607558e273f04a52231ae05fee67ed73f4b061ef0638089fa72a321a99a787cf3f4cc1ae471c7f3bc5bb064001aec0faa9344

Malware Config

Signatures

  • NetWire RAT payload 1 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OrderNo-202000125.exe
    "C:\Users\Admin\AppData\Local\Temp\OrderNo-202000125.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:800
    • C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      2⤵
        PID:2900

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/800-2-0x0000000000770000-0x0000000000771000-memory.dmp
      Filesize

      4KB

    • memory/2900-4-0x0000000000000000-mapping.dmp
    • memory/2900-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
      Filesize

      4KB

    • memory/2900-5-0x0000000000D80000-0x0000000000D81000-memory.dmp
      Filesize

      4KB

    • memory/2900-7-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
      Filesize

      4KB

    • memory/2900-12-0x0000000010550000-0x0000000010585000-memory.dmp
      Filesize

      212KB

    • memory/2900-13-0x0000000000D00000-0x0000000000D33000-memory.dmp
      Filesize

      204KB