Analysis

  • max time kernel
    119s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    21-07-2021 07:33

General

  • Target

    order.exe

  • Size

    838KB

  • MD5

    587f6655380282c9fb7997fa2225438e

  • SHA1

    5b45eb58ef1d1cd93df0ecfc7b4124644515e93c

  • SHA256

    9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb

  • SHA512

    1b97c465d355d8fa6355c7b856ba7eebac8b8c4bdd9c482b1a8fa6c558309356cfb80ac3373737b269c1ca9c4df03294daee918a34500e45874c1b6fc32ce488

Malware Config

Extracted

Family

netwire

C2

84.38.129.130:19891

Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    iFwvrEFs

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • startup_name

  • use_mutex

    true

Signatures

  • NetWire RAT payload 5 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\order.exe
    "C:\Users\Admin\AppData\Local\Temp\order.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BFzyfsQWtX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4089.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1576
    • C:\Users\Admin\AppData\Local\Temp\order.exe
      "{path}"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:668
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1316
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BFzyfsQWtX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD81.tmp"
          4⤵
          • Creates scheduled task(s)
          PID:820
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "{path}"
          4⤵
          • Executes dropped EXE
          PID:1140

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp4089.tmp
    MD5

    1ae138434b42aee6b9e7eb8d641dc3da

    SHA1

    cffd65cd0bb4c87b5b46a0346f8a331809e96551

    SHA256

    a3d19cc5613e1a3ecee771a6a350211d98d5eb601cd5ff37bdc16452beb41591

    SHA512

    6a3c4352c23f317a63c25e818526fe6168c193709009b1f9924b114ee08cb92b0b3172d01a1e0edcf4944d17dd83ee5c5eba64386f313fdb16e4c3f3b61b2e96

  • C:\Users\Admin\AppData\Local\Temp\tmpFD81.tmp
    MD5

    1ae138434b42aee6b9e7eb8d641dc3da

    SHA1

    cffd65cd0bb4c87b5b46a0346f8a331809e96551

    SHA256

    a3d19cc5613e1a3ecee771a6a350211d98d5eb601cd5ff37bdc16452beb41591

    SHA512

    6a3c4352c23f317a63c25e818526fe6168c193709009b1f9924b114ee08cb92b0b3172d01a1e0edcf4944d17dd83ee5c5eba64386f313fdb16e4c3f3b61b2e96

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    MD5

    587f6655380282c9fb7997fa2225438e

    SHA1

    5b45eb58ef1d1cd93df0ecfc7b4124644515e93c

    SHA256

    9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb

    SHA512

    1b97c465d355d8fa6355c7b856ba7eebac8b8c4bdd9c482b1a8fa6c558309356cfb80ac3373737b269c1ca9c4df03294daee918a34500e45874c1b6fc32ce488

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    MD5

    587f6655380282c9fb7997fa2225438e

    SHA1

    5b45eb58ef1d1cd93df0ecfc7b4124644515e93c

    SHA256

    9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb

    SHA512

    1b97c465d355d8fa6355c7b856ba7eebac8b8c4bdd9c482b1a8fa6c558309356cfb80ac3373737b269c1ca9c4df03294daee918a34500e45874c1b6fc32ce488

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    MD5

    587f6655380282c9fb7997fa2225438e

    SHA1

    5b45eb58ef1d1cd93df0ecfc7b4124644515e93c

    SHA256

    9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb

    SHA512

    1b97c465d355d8fa6355c7b856ba7eebac8b8c4bdd9c482b1a8fa6c558309356cfb80ac3373737b269c1ca9c4df03294daee918a34500e45874c1b6fc32ce488

  • \Users\Admin\AppData\Roaming\Install\Host.exe
    MD5

    587f6655380282c9fb7997fa2225438e

    SHA1

    5b45eb58ef1d1cd93df0ecfc7b4124644515e93c

    SHA256

    9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb

    SHA512

    1b97c465d355d8fa6355c7b856ba7eebac8b8c4bdd9c482b1a8fa6c558309356cfb80ac3373737b269c1ca9c4df03294daee918a34500e45874c1b6fc32ce488

  • memory/668-77-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/668-68-0x000000000040242D-mapping.dmp
  • memory/668-69-0x0000000074F31000-0x0000000074F33000-memory.dmp
    Filesize

    8KB

  • memory/668-67-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/820-81-0x0000000000000000-mapping.dmp
  • memory/1140-87-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/1140-84-0x000000000040242D-mapping.dmp
  • memory/1316-78-0x00000000009D0000-0x00000000009D1000-memory.dmp
    Filesize

    4KB

  • memory/1316-71-0x0000000000000000-mapping.dmp
  • memory/1316-74-0x0000000000EF0000-0x0000000000EF1000-memory.dmp
    Filesize

    4KB

  • memory/1576-65-0x0000000000000000-mapping.dmp
  • memory/1852-59-0x00000000008A0000-0x00000000008A1000-memory.dmp
    Filesize

    4KB

  • memory/1852-62-0x0000000000490000-0x0000000000492000-memory.dmp
    Filesize

    8KB

  • memory/1852-63-0x0000000004B50000-0x0000000004C03000-memory.dmp
    Filesize

    716KB

  • memory/1852-61-0x0000000005100000-0x0000000005101000-memory.dmp
    Filesize

    4KB

  • memory/1852-64-0x0000000004AA0000-0x0000000004B0F000-memory.dmp
    Filesize

    444KB