Analysis
- max time kernel
18s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
23/02/2021, 07:27
General
- Target SKBMT_ 5870Z904_ Image.exe
- Size 376KB
- Sample210223-xlnfcb7gl6
- SHA256 2e5fa5d3014a67a660612edaddf0e5abf60d7b0f8b82336b17ab6464c4567d03
Malware Config
Signatures
- NetWire RAT payload 3 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe"C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe"C:\Users\Admin\AppData\Local\Temp\SKBMT_ 5870Z904_ Image.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3116-16-0x00000000056B0000-0x00000000056BF000-memory.dmp
memory/3116-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/3116-5-0x0000000005BE0000-0x0000000005BE1000-memory.dmp
memory/3116-6-0x00000000056E0000-0x00000000056E1000-memory.dmp
memory/3116-7-0x0000000005780000-0x00000000057D9000-memory.dmp
memory/3116-8-0x0000000005880000-0x0000000005881000-memory.dmp
memory/3116-9-0x0000000005930000-0x0000000005931000-memory.dmp
memory/3116-2-0x0000000073840000-0x0000000073F2E000-memory.dmp
memory/3600-24-0x0000000007B20000-0x0000000007B21000-memory.dmp
memory/3600-20-0x0000000006E80000-0x0000000006E81000-memory.dmp
memory/3600-13-0x00000000071A0000-0x00000000071A1000-memory.dmp
memory/3600-14-0x0000000001210000-0x0000000001211000-memory.dmp
memory/3600-15-0x0000000001212000-0x0000000001213000-memory.dmp
memory/3600-11-0x0000000073840000-0x0000000073F2E000-memory.dmp
memory/3600-31-0x0000000001213000-0x0000000001214000-memory.dmp
memory/3600-29-0x0000000008C70000-0x0000000008C71000-memory.dmp
memory/3600-28-0x0000000008C00000-0x0000000008C01000-memory.dmp
memory/3600-12-0x0000000000FA0000-0x0000000000FA1000-memory.dmp
memory/3600-21-0x0000000007100000-0x0000000007101000-memory.dmp
memory/3600-22-0x0000000007090000-0x0000000007091000-memory.dmp
memory/3600-23-0x00000000077D0000-0x00000000077D1000-memory.dmp
memory/3600-25-0x0000000008160000-0x0000000008161000-memory.dmp
memory/3600-26-0x0000000007EC0000-0x0000000007EC1000-memory.dmp
memory/3600-27-0x0000000008CE0000-0x0000000008CE1000-memory.dmp
memory/4072-19-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4072-17-0x0000000000400000-0x0000000000433000-memory.dmp