Analysis

  • max time kernel
    137s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-en
  • submitted
    15-09-2021 07:06

General

  • Target

    450f463616026025f68295b9a3dd365f.exe

  • Size

    779KB

  • MD5

    450f463616026025f68295b9a3dd365f

  • SHA1

    440c0e1d874ebd9c3f86b672f24b39d7c857baa3

  • SHA256

    c96f0650573130180a039e7b9d66d11e18c97c9fe96c732f2d5fdbcb05a140eb

  • SHA512

    7fb9e37bb037f48779b508863f9dacd9714214adc4642619978b9cf90cd19311ad0f122512a41e4d91ad55bd25d7f076266e93f60cfb9df7e8cf325149d4b76f

Malware Config

Extracted

Family

netwire

C2

176.107.178.179:5218

134.19.179.147:5214

139.28.36.101:5218

Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    false

  • delete_original

    false

  • host_id

    31-Aug

  • install_path

  • keylogger_dir

    %AppData%\Local\Nets\

  • lock_executable

    true

  • mutex

    iXSIGucL

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • startup_name

  • use_mutex

    true

Signatures

  • NetWire RAT payload 1 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\450f463616026025f68295b9a3dd365f.exe
    "C:\Users\Admin\AppData\Local\Temp\450f463616026025f68295b9a3dd365f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:820
    • C:\Users\Admin\AppData\Local\Temp\450f463616026025f68295b9a3dd365f.exe
      C:\Users\Admin\AppData\Local\Temp\450f463616026025f68295b9a3dd365f.exe
      2⤵
      • Adds Run key to start application
      PID:1920
      • C:\Windows\SysWOW64\dialer.exe
        C:\Windows\System32\dialer.exe
        3⤵
          PID:2348
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Public\Trast.bat" "
          3⤵
            PID:2380
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
              4⤵
                PID:2432
                • C:\Windows\SysWOW64\reg.exe
                  reg delete hkcu\Environment /v windir /f
                  5⤵
                  • Modifies registry key
                  PID:2468
                • C:\Windows\SysWOW64\reg.exe
                  reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
                  5⤵
                  • Modifies registry key
                  PID:2480
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
                  5⤵
                    PID:2492
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\Users\Public\nest.bat" "
                3⤵
                  PID:2516
                  • C:\Windows\SysWOW64\reg.exe
                    reg delete hkcu\Environment /v windir /f
                    4⤵
                    • Modifies registry key
                    PID:2548

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Persistence

            Registry Run Keys / Startup Folder

            1
            T1060

            Defense Evasion

            Modify Registry

            2
            T1112

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Public\Trast.bat
              MD5

              4068c9f69fcd8a171c67f81d4a952a54

              SHA1

              4d2536a8c28cdcc17465e20d6693fb9e8e713b36

              SHA256

              24222300c78180b50ed1f8361ba63cb27316ec994c1c9079708a51b4a1a9d810

              SHA512

              a64f9319acc51fffd0491c74dcd9c9084c2783b82f95727e4bfe387a8528c6dcf68f11418e88f1e133d115daf907549c86dd7ad866b2a7938add5225fbb2811d

            • C:\Users\Public\UKO.bat
              MD5

              eaf8d967454c3bbddbf2e05a421411f8

              SHA1

              6170880409b24de75c2dc3d56a506fbff7f6622c

              SHA256

              f35f2658455a2e40f151549a7d6465a836c33fa9109e67623916f889849eac56

              SHA512

              fe5be5c673e99f70c93019d01abb0a29dd2ecf25b2d895190ff551f020c28e7d8f99f65007f440f0f76c5bcac343b2a179a94d190c938ea3b9e1197890a412e9

            • C:\Users\Public\nest.bat
              MD5

              8ada51400b7915de2124baaf75e3414c

              SHA1

              1a7b9db12184ab7fd7fce1c383f9670a00adb081

              SHA256

              45aa3957c29865260a78f03eef18ae9aebdbf7bea751ecc88be4a799f2bb46c7

              SHA512

              9afc138157a4565294ca49942579cdb6f5d8084e56f9354738de62b585f4c0fa3e7f2cbc9541827f2084e3ff36c46eed29b46f5dd2444062ffcd05c599992e68

            • memory/820-53-0x0000000000220000-0x0000000000221000-memory.dmp
              Filesize

              4KB

            • memory/820-56-0x0000000010410000-0x000000001042B000-memory.dmp
              Filesize

              108KB

            • memory/1920-55-0x0000000000000000-mapping.dmp
            • memory/1920-60-0x0000000000330000-0x0000000000331000-memory.dmp
              Filesize

              4KB

            • memory/1920-59-0x00000000001B0000-0x00000000001B1000-memory.dmp
              Filesize

              4KB

            • memory/2348-66-0x0000000010550000-0x0000000010585000-memory.dmp
              Filesize

              212KB

            • memory/2348-74-0x0000000000080000-0x0000000000081000-memory.dmp
              Filesize

              4KB

            • memory/2348-65-0x00000000002C0000-0x00000000002C1000-memory.dmp
              Filesize

              4KB

            • memory/2348-67-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2348-64-0x0000000000100000-0x0000000000101000-memory.dmp
              Filesize

              4KB

            • memory/2348-61-0x0000000000000000-mapping.dmp
            • memory/2348-62-0x0000000076071000-0x0000000076073000-memory.dmp
              Filesize

              8KB

            • memory/2380-63-0x0000000000000000-mapping.dmp
            • memory/2432-69-0x0000000000000000-mapping.dmp
            • memory/2468-71-0x0000000000000000-mapping.dmp
            • memory/2480-72-0x0000000000000000-mapping.dmp
            • memory/2492-73-0x0000000000000000-mapping.dmp
            • memory/2516-75-0x0000000000000000-mapping.dmp
            • memory/2548-77-0x0000000000000000-mapping.dmp