Analysis

  • max time kernel
    19s
  • max time network
    71s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    19-07-2021 15:13

General

  • Target

    b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a.bin.exe

  • Size

    1.2MB

  • MD5

    2d619dfd3178ee2ffbcfc488c1211d4f

  • SHA1

    971cf6179b962d3612d0aff277960e0638017401

  • SHA256

    b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a

  • SHA512

    0611fd9ec274528b0b1a993291bfcec35e9aabb54203855b524cccc70e582958686239cce33c1c01427cc5d8a3baeb13d753c03feaf00b856a72742808f0c7fe

Malware Config

Signatures

  • NetWire RAT payload 2 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a.bin.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Users\Admin\AppData\Local\Temp\b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a.bin.exe
      "C:\Users\Admin\AppData\Local\Temp\b325c03e9582b83c544796f4518fa68b93053b1d21079049f9a8ddf6700a392a.bin.exe"
      2⤵
        PID:544
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 8
          3⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          PID:3316

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/544-114-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/544-115-0x00000000004021DA-mapping.dmp
    • memory/652-116-0x0000000001B60000-0x0000000001B61000-memory.dmp
      Filesize

      4KB