Analysis
- max time kernel
8s - max time network
150s - platform
windows7_x64 - resource
win7v20201028 - submitted
23/02/2021, 07:27
General
- Target SKBMT_ 5870Z904_ Image.exe
- Size 376KB
- Sample210223-xlnfcb7gl6
- SHA256 2e5fa5d3014a67a660612edaddf0e5abf60d7b0f8b82336b17ab6464c4567d03
Malware Config
Signatures
- NetWire RAT payload 3 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe"C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe"C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/296-2-0x00000000748D0000-0x0000000074FBE000-memory.dmp
memory/296-3-0x00000000008C0000-0x00000000008C1000-memory.dmp
memory/296-5-0x00000000044A0000-0x00000000044A1000-memory.dmp
memory/296-6-0x00000000004E0000-0x0000000000539000-memory.dmp
memory/296-14-0x0000000000220000-0x000000000022F000-memory.dmp
memory/1732-20-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1732-15-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1968-13-0x0000000004912000-0x0000000004913000-memory.dmp
memory/1968-19-0x0000000004880000-0x0000000004881000-memory.dmp
memory/1968-11-0x0000000004950000-0x0000000004951000-memory.dmp
memory/1968-10-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
memory/1968-9-0x00000000748D0000-0x0000000074FBE000-memory.dmp
memory/1968-8-0x0000000076381000-0x0000000076383000-memory.dmp
memory/1968-18-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/1968-12-0x0000000004910000-0x0000000004911000-memory.dmp
memory/1968-23-0x0000000005660000-0x0000000005661000-memory.dmp
memory/1968-28-0x00000000056B0000-0x00000000056B1000-memory.dmp
memory/1968-29-0x0000000006150000-0x0000000006151000-memory.dmp
memory/1968-36-0x0000000006280000-0x0000000006281000-memory.dmp
memory/1968-37-0x000000007EF30000-0x000000007EF31000-memory.dmp