Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-04-2021 12:04

General

  • Target

    9de81c4b0f4d76ada494588b6250165091db9f1b7e1b9cc84a4f621aafa92362.exe

  • Size

    644KB

  • MD5

    aa7f4ac1c779a113a1f6deefe4980ae6

  • SHA1

    7de6c7563fb13e8ae9fe682e79a2a65145aaf491

  • SHA256

    9de81c4b0f4d76ada494588b6250165091db9f1b7e1b9cc84a4f621aafa92362

  • SHA512

    8280cb3488f909599ecdc25517a4520320dab86a63e446cce46d045d04373d4826939bcf55088bad19dad542b5f5731bd1cee80cc3be5f4e8dc5e269bbbab230

Malware Config

Extracted

Family

netwire

C2

194.5.98.97:3366

194.5.98.97:4081

194.5.98.97:3369

Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

  • offline_keylogger

    true

  • password

    Kemme

  • registry_autorun

    false

  • startup_name

  • use_mutex

    false

Signatures

  • NetWire RAT payload 3 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9de81c4b0f4d76ada494588b6250165091db9f1b7e1b9cc84a4f621aafa92362.exe
    "C:\Users\Admin\AppData\Local\Temp\9de81c4b0f4d76ada494588b6250165091db9f1b7e1b9cc84a4f621aafa92362.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GLLPQuNowPwnfL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1CEF.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4008
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
        PID:1284

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp1CEF.tmp
      MD5

      3e2dcea3906ccb62f7e1e2f70bb847df

      SHA1

      3d054f1ac1ca1af2bd5710deb776984089b5c3f1

      SHA256

      a00500a1e3a0a7c6c636326918958732c1bf5862a81abf9cb8300f9713be1cd8

      SHA512

      96d4b5ea27e53b177f65584866f485d840a17296654f976be2510a095cc1bbf88fe6b5db796efc478adb6e4301f4749a3e880574397a297538719d60b79f1b53

    • memory/808-121-0x0000000008340000-0x0000000008345000-memory.dmp
      Filesize

      20KB

    • memory/808-117-0x0000000004D60000-0x0000000004D61000-memory.dmp
      Filesize

      4KB

    • memory/808-118-0x0000000004E00000-0x0000000004E01000-memory.dmp
      Filesize

      4KB

    • memory/808-119-0x0000000004E50000-0x000000000534E000-memory.dmp
      Filesize

      5.0MB

    • memory/808-120-0x0000000008360000-0x0000000008361000-memory.dmp
      Filesize

      4KB

    • memory/808-114-0x0000000000490000-0x0000000000491000-memory.dmp
      Filesize

      4KB

    • memory/808-122-0x0000000008680000-0x00000000086F4000-memory.dmp
      Filesize

      464KB

    • memory/808-123-0x000000000ACF0000-0x000000000AD1B000-memory.dmp
      Filesize

      172KB

    • memory/808-116-0x0000000005350000-0x0000000005351000-memory.dmp
      Filesize

      4KB

    • memory/1284-126-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1284-127-0x000000000040242D-mapping.dmp
    • memory/1284-128-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/4008-124-0x0000000000000000-mapping.dmp