Analysis
-
max time kernel
96s -
max time network
110s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-07-2021 07:16
Static task
static1
Behavioral task
behavioral1
Sample
AttachedWaybill.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
AttachedWaybill.exe
Resource
win10v20210410
General
-
Target
AttachedWaybill.exe
-
Size
574KB
-
MD5
33f9d631a4adcd4c64fe639352c5f76b
-
SHA1
8828f41d318315eb05818fce4499bffa31657160
-
SHA256
82e96593173c1407d138cca5418a00b0f5cd9960b32d8f03052eca9b33e68b44
-
SHA512
58818cd5e1d55a4a610bb9836501a6d89fb04209b4275420bc96433af1484c0573bf1851b561779144642dd178152ca871841988864de099334ebe0372d83339
Malware Config
Extracted
netwire
nbg.myvnc.com:6655
nbg1.myvnc.com:6655
myb25.camdvr.org:6655
nbg2.myvnc.com:6655
myb27.camdvr.org:6655
nerdmusic.freeddns.org:6655
SUNWAP1.ooguy.com:6655
mynw1.hopto.org:6655
myb24.camdvr.org:6655
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
COVID-19
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
1234
-
registry_autorun
false
- startup_name
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1232-72-0x00000000001F0000-0x0000000000223000-memory.dmp netwire -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AttachedWaybill.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rjwkhtt = "C:\\Users\\Public\\Libraries\\tthkwjR.url" AttachedWaybill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
AttachedWaybill.exedescription pid process target process PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe PID 1776 wrote to memory of 1232 1776 AttachedWaybill.exe mshta.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-66-0x0000000000000000-mapping.dmp
-
memory/1232-69-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1232-68-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1232-71-0x0000000010550000-0x0000000010585000-memory.dmpFilesize
212KB
-
memory/1232-70-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1232-72-0x00000000001F0000-0x0000000000223000-memory.dmpFilesize
204KB
-
memory/1776-61-0x00000000003D0000-0x00000000003EA000-memory.dmpFilesize
104KB
-
memory/1776-64-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1776-65-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB