Analysis

  • max time kernel
    39s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    25-07-2021 04:02

General

  • Target

    A582F8176C5F4BECF5F95A563E9EC11A.exe

  • Size

    1.1MB

  • MD5

    a582f8176c5f4becf5f95a563e9ec11a

  • SHA1

    a8b2fd3f57157cce4fe9442b8ffa53e15ca4820c

  • SHA256

    bd62e723aff056a5f6dd9b9ece4f5ea4bae0a50cc3bdd5f4228fb265c2a96170

  • SHA512

    b077839b7a01290ade4632342e20dcc2885036deccd0a32d685a99efd2abbfd6f29ce5739f2145d8d439f8816092ad73612a15263580f356d9d727a4d8099fb0

Malware Config

Extracted

Family

netwire

C2

roban.giize.com:1604

Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

  • keylogger_dir

  • lock_executable

    false

  • mutex

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • startup_name

  • use_mutex

    false

Signatures

  • NetWire RAT payload 3 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe
    "C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell" copy-item 'C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\koleno.exe'
      2⤵
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2288
    • C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe
      "C:\Users\Admin\AppData\Local\Temp\A582F8176C5F4BECF5F95A563E9EC11A.exe"
      2⤵
        PID:2236

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/664-116-0x0000000005770000-0x0000000005771000-memory.dmp
      Filesize

      4KB

    • memory/664-131-0x0000000005A10000-0x0000000005F0E000-memory.dmp
      Filesize

      5.0MB

    • memory/664-118-0x0000000005F10000-0x0000000005F11000-memory.dmp
      Filesize

      4KB

    • memory/664-130-0x0000000005A10000-0x0000000005F0E000-memory.dmp
      Filesize

      5.0MB

    • memory/664-114-0x0000000000D10000-0x0000000000D11000-memory.dmp
      Filesize

      4KB

    • memory/664-123-0x0000000005AC0000-0x0000000005AD5000-memory.dmp
      Filesize

      84KB

    • memory/2236-129-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/2236-124-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/2236-125-0x000000000040242D-mapping.dmp
    • memory/2288-126-0x0000000004960000-0x0000000004961000-memory.dmp
      Filesize

      4KB

    • memory/2288-133-0x0000000007950000-0x0000000007951000-memory.dmp
      Filesize

      4KB

    • memory/2288-127-0x0000000007110000-0x0000000007111000-memory.dmp
      Filesize

      4KB

    • memory/2288-122-0x0000000007320000-0x0000000007321000-memory.dmp
      Filesize

      4KB

    • memory/2288-121-0x0000000001230000-0x0000000001231000-memory.dmp
      Filesize

      4KB

    • memory/2288-117-0x0000000000000000-mapping.dmp
    • memory/2288-132-0x00000000071B0000-0x00000000071B1000-memory.dmp
      Filesize

      4KB

    • memory/2288-128-0x0000000004962000-0x0000000004963000-memory.dmp
      Filesize

      4KB

    • memory/2288-134-0x0000000007B30000-0x0000000007B31000-memory.dmp
      Filesize

      4KB

    • memory/2288-135-0x0000000006DD0000-0x0000000006DD1000-memory.dmp
      Filesize

      4KB

    • memory/2288-136-0x00000000081A0000-0x00000000081A1000-memory.dmp
      Filesize

      4KB

    • memory/2288-137-0x0000000008200000-0x0000000008201000-memory.dmp
      Filesize

      4KB

    • memory/2288-142-0x00000000091D0000-0x00000000091D1000-memory.dmp
      Filesize

      4KB

    • memory/2288-143-0x0000000008E80000-0x0000000008E81000-memory.dmp
      Filesize

      4KB

    • memory/2288-144-0x0000000008EF0000-0x0000000008EF1000-memory.dmp
      Filesize

      4KB

    • memory/2288-147-0x0000000004963000-0x0000000004964000-memory.dmp
      Filesize

      4KB