Analysis

  • max time kernel
    12s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    23-07-2021 05:03

General

  • Target

    35A80E79A290DFCE0D019D467EC8DC9C.exe

  • Size

    2MB

  • MD5

    35a80e79a290dfce0d019d467ec8dc9c

  • SHA1

    c9e67190debfb937b1c148b5c1c0f2869e4c0b8a

  • SHA256

    ee70cb2fc82abe10d225555baf80864b1c8f779fce79dcb2b76943d145a8130e

  • SHA512

    5916e9bc037a5e95fdeb8cc519cea95e3d63c25a1940673c99713621133463c32e5c6ce8bd7c7635c666a1c76c8dfe1554b14719f2f0e5acd9a77fe8da7e7b03

Malware Config

Extracted

Family

netwire

C2

finerthings.duckdns.org:3021

Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    false

  • delete_original

    false

  • host_id

    H23053OIGS

  • install_path

  • keylogger_dir

  • lock_executable

    false

  • mutex

  • offline_keylogger

    false

  • password

    finerthings@963

  • registry_autorun

    false

  • startup_name

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 6 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35A80E79A290DFCE0D019D467EC8DC9C.exe
    "C:\Users\Admin\AppData\Local\Temp\35A80E79A290DFCE0D019D467EC8DC9C.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Users\Admin\AppData\Local\Temp\DDllsystem.exe
      "C:\Users\Admin\AppData\Local\Temp\DDllsystem.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Users\Admin\AppData\Local\Temp\DDllsystem.exe
        "C:\Users\Admin\AppData\Local\Temp\DDllsystem.exe"
        3⤵
        • Executes dropped EXE
        PID:3484

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DDllsystem.exe
    MD5

    959be976070ea4820a2e24dcce3d0bdf

    SHA1

    7ec0c6d7d9b75ef8f078383a15d977b45dc434c1

    SHA256

    6b4dd13ea6241a6c8ad2c967d88f3336798dc1e30dd24cfa3377f9b363d70b2e

    SHA512

    de3ed25149af67a28cd5659bfeb895e323bbd9e79bb791bfbe972f448ca1012d4872b4478bd321a8baefd5813dd69fb19d73ff02d078f5b99ab6618946d4455e

  • C:\Users\Admin\AppData\Local\Temp\DDllsystem.exe
    MD5

    959be976070ea4820a2e24dcce3d0bdf

    SHA1

    7ec0c6d7d9b75ef8f078383a15d977b45dc434c1

    SHA256

    6b4dd13ea6241a6c8ad2c967d88f3336798dc1e30dd24cfa3377f9b363d70b2e

    SHA512

    de3ed25149af67a28cd5659bfeb895e323bbd9e79bb791bfbe972f448ca1012d4872b4478bd321a8baefd5813dd69fb19d73ff02d078f5b99ab6618946d4455e

  • C:\Users\Admin\AppData\Local\Temp\DDllsystem.exe
    MD5

    959be976070ea4820a2e24dcce3d0bdf

    SHA1

    7ec0c6d7d9b75ef8f078383a15d977b45dc434c1

    SHA256

    6b4dd13ea6241a6c8ad2c967d88f3336798dc1e30dd24cfa3377f9b363d70b2e

    SHA512

    de3ed25149af67a28cd5659bfeb895e323bbd9e79bb791bfbe972f448ca1012d4872b4478bd321a8baefd5813dd69fb19d73ff02d078f5b99ab6618946d4455e

  • \Users\Admin\AppData\Local\Temp\kxtmnugf.dll
    MD5

    c6740f343d8777430307336fcb50d504

    SHA1

    54e4bafc84ab18dab87731ee3b3647d923af7fd7

    SHA256

    03d53a25652bbf853ab65f0428ebc68db0497654206b95bb86f0d45f0b0ebd70

    SHA512

    ae4e1919d94a23d522996ac86c920aaf7d05b1aa7d3596521c9b7fcfcee5a890249ab825b0cc5d4a3dc75ac54db5248500c1c11b676caebf49811f6eed887ff2

  • memory/1228-122-0x0000000000000000-mapping.dmp
  • memory/3484-128-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/3484-126-0x000000000040242D-mapping.dmp
  • memory/4068-118-0x0000000004F02000-0x0000000004F03000-memory.dmp
    Filesize

    4KB

  • memory/4068-121-0x0000000002900000-0x0000000002901000-memory.dmp
    Filesize

    4KB

  • memory/4068-119-0x0000000004F03000-0x0000000004F04000-memory.dmp
    Filesize

    4KB

  • memory/4068-120-0x0000000004F04000-0x0000000004F06000-memory.dmp
    Filesize

    8KB

  • memory/4068-117-0x0000000004F00000-0x0000000004F01000-memory.dmp
    Filesize

    4KB

  • memory/4068-114-0x00000000025C0000-0x00000000025D5000-memory.dmp
    Filesize

    84KB

  • memory/4068-116-0x00000000028C0000-0x00000000028D3000-memory.dmp
    Filesize

    76KB

  • memory/4068-115-0x0000000004F10000-0x0000000004F11000-memory.dmp
    Filesize

    4KB