Analysis

  • max time kernel
    98s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    21-07-2021 07:09

General

  • Target

    Order.exe

  • Size

    853KB

  • MD5

    103362e59d9fd456e9ce47da23e14e4f

  • SHA1

    5f557d79f1085f1e05da881204d341f2c82b20b9

  • SHA256

    f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40

  • SHA512

    b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e

Malware Config

Extracted

Family

netwire

C2

37.120.234.120:19792

Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    FvEKqKqS

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • startup_name

  • use_mutex

    true

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • NetWire RAT payload 4 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Order.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vabtzuyh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7C8.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1908
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "{path}"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3908
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vabtzuyh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp93D4.tmp"
          4⤵
          • Creates scheduled task(s)
          PID:2684
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "{path}"
          4⤵
          • Executes dropped EXE
          PID:2176

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp93D4.tmp
    MD5

    67180dc7300556e57f7896c0706b426b

    SHA1

    95291f6b8b7e7b0658259e304111847b4b355344

    SHA256

    b4909a6679d9ead1ac51fbc7fff2ac8fef67eaf31057091645c08fdd51cff596

    SHA512

    6b70ad1f2d8b270ce1a85c948b05b9fa73351c7ed260b374a8aa82e9ba77f8d729f4470c1c91c648756e351f2c9d0afff84e66ac8f063f6f09d4a648f3dfcfa9

  • C:\Users\Admin\AppData\Local\Temp\tmpD7C8.tmp
    MD5

    67180dc7300556e57f7896c0706b426b

    SHA1

    95291f6b8b7e7b0658259e304111847b4b355344

    SHA256

    b4909a6679d9ead1ac51fbc7fff2ac8fef67eaf31057091645c08fdd51cff596

    SHA512

    6b70ad1f2d8b270ce1a85c948b05b9fa73351c7ed260b374a8aa82e9ba77f8d729f4470c1c91c648756e351f2c9d0afff84e66ac8f063f6f09d4a648f3dfcfa9

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    MD5

    103362e59d9fd456e9ce47da23e14e4f

    SHA1

    5f557d79f1085f1e05da881204d341f2c82b20b9

    SHA256

    f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40

    SHA512

    b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    MD5

    103362e59d9fd456e9ce47da23e14e4f

    SHA1

    5f557d79f1085f1e05da881204d341f2c82b20b9

    SHA256

    f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40

    SHA512

    b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    MD5

    103362e59d9fd456e9ce47da23e14e4f

    SHA1

    5f557d79f1085f1e05da881204d341f2c82b20b9

    SHA256

    f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40

    SHA512

    b20e271dfebd76f3353374026eb5b9633f75c3fe359d7c2e17af40b8470b91ff059b757148c11f0287e3d833db3523695035c3313230d8e6662456f928eead6e

  • memory/1092-126-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/1092-138-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/1092-127-0x000000000040242D-mapping.dmp
  • memory/1908-124-0x0000000000000000-mapping.dmp
  • memory/2176-145-0x000000000040242D-mapping.dmp
  • memory/2684-142-0x0000000000000000-mapping.dmp
  • memory/3908-139-0x00000000057C0000-0x0000000005CBE000-memory.dmp
    Filesize

    5.0MB

  • memory/3908-128-0x0000000000000000-mapping.dmp
  • memory/3948-118-0x00000000052A0000-0x00000000052A1000-memory.dmp
    Filesize

    4KB

  • memory/3948-117-0x0000000005200000-0x0000000005201000-memory.dmp
    Filesize

    4KB

  • memory/3948-114-0x0000000000900000-0x0000000000901000-memory.dmp
    Filesize

    4KB

  • memory/3948-119-0x0000000005310000-0x000000000580E000-memory.dmp
    Filesize

    5.0MB

  • memory/3948-123-0x00000000089B0000-0x0000000008A1B000-memory.dmp
    Filesize

    428KB

  • memory/3948-122-0x00000000088B0000-0x0000000008967000-memory.dmp
    Filesize

    732KB

  • memory/3948-116-0x0000000005810000-0x0000000005811000-memory.dmp
    Filesize

    4KB

  • memory/3948-121-0x0000000007380000-0x0000000007381000-memory.dmp
    Filesize

    4KB

  • memory/3948-120-0x0000000005390000-0x0000000005392000-memory.dmp
    Filesize

    8KB