Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-07-2021 06:14
Static task
static1
Behavioral task
behavioral1
Sample
AttachedWaybill.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
AttachedWaybill.exe
Resource
win10v20210408
General
-
Target
AttachedWaybill.exe
-
Size
574KB
-
MD5
33f9d631a4adcd4c64fe639352c5f76b
-
SHA1
8828f41d318315eb05818fce4499bffa31657160
-
SHA256
82e96593173c1407d138cca5418a00b0f5cd9960b32d8f03052eca9b33e68b44
-
SHA512
58818cd5e1d55a4a610bb9836501a6d89fb04209b4275420bc96433af1484c0573bf1851b561779144642dd178152ca871841988864de099334ebe0372d83339
Malware Config
Extracted
netwire
nbg.myvnc.com:6655
nbg1.myvnc.com:6655
myb25.camdvr.org:6655
nbg2.myvnc.com:6655
myb27.camdvr.org:6655
nerdmusic.freeddns.org:6655
SUNWAP1.ooguy.com:6655
mynw1.hopto.org:6655
myb24.camdvr.org:6655
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
COVID-19
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
1234
-
registry_autorun
false
- startup_name
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1164-66-0x0000000000000000-mapping.dmp netwire behavioral1/memory/1164-71-0x00000000002E0000-0x0000000000313000-memory.dmp netwire -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AttachedWaybill.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rjwkhtt = "C:\\Users\\Public\\Libraries\\tthkwjR.url" AttachedWaybill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
AttachedWaybill.exedescription pid process target process PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe PID 1888 wrote to memory of 1164 1888 AttachedWaybill.exe DpiScaling.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-66-0x0000000000000000-mapping.dmp
-
memory/1164-69-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1164-68-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1164-71-0x00000000002E0000-0x0000000000313000-memory.dmpFilesize
204KB
-
memory/1164-70-0x0000000010550000-0x0000000010585000-memory.dmpFilesize
212KB
-
memory/1164-72-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1888-60-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1888-62-0x00000000003D0000-0x00000000003EA000-memory.dmpFilesize
104KB
-
memory/1888-65-0x0000000075161000-0x0000000075163000-memory.dmpFilesize
8KB