Analysis
-
max time kernel
121s -
max time network
140s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
18-10-2021 11:30
Static task
static1
Behavioral task
behavioral1
Sample
Details.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Details.exe
Resource
win10-en-20211014
General
-
Target
Details.exe
-
Size
123KB
-
MD5
a6d253e02a22e26939f3d775ee1127cd
-
SHA1
a8e827a9c4916a4b85e5e783764173df0dadd116
-
SHA256
61722636c5cad31d212e7ea1da55d4fde3a7e93fc46f81484dd7597a684a8164
-
SHA512
dc13d3e6a721cc2673663d0b70fcae92ed2316f4b247039dcdf8e6312a0525fc14209c4c1f860da3d04939095f1f7a912d60b20f0242dbf6ff95bc341eaada82
Malware Config
Extracted
netwire
213.152.162.181:5133
184.75.221.171:5133
199.249.230.27:5133
185.103.96.143:5133
185.104.184.43:5133
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
- install_path
- keylogger_dir
-
lock_executable
true
-
mutex
SeDCqQtm
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-63-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1900-62-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1900-64-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1900-65-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1900-66-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1900-67-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1900-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Details.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\chrome.exe\"" Details.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Details.exedescription pid process target process PID 1768 set thread context of 1900 1768 Details.exe Details.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
Details.exepid process 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe 1768 Details.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Details.exedescription pid process Token: SeDebugPrivilege 1768 Details.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
Details.exedescription pid process target process PID 1768 wrote to memory of 1060 1768 Details.exe Details.exe PID 1768 wrote to memory of 1060 1768 Details.exe Details.exe PID 1768 wrote to memory of 1060 1768 Details.exe Details.exe PID 1768 wrote to memory of 1060 1768 Details.exe Details.exe PID 1768 wrote to memory of 1060 1768 Details.exe Details.exe PID 1768 wrote to memory of 1060 1768 Details.exe Details.exe PID 1768 wrote to memory of 1060 1768 Details.exe Details.exe PID 1768 wrote to memory of 880 1768 Details.exe Details.exe PID 1768 wrote to memory of 880 1768 Details.exe Details.exe PID 1768 wrote to memory of 880 1768 Details.exe Details.exe PID 1768 wrote to memory of 880 1768 Details.exe Details.exe PID 1768 wrote to memory of 880 1768 Details.exe Details.exe PID 1768 wrote to memory of 880 1768 Details.exe Details.exe PID 1768 wrote to memory of 880 1768 Details.exe Details.exe PID 1768 wrote to memory of 1292 1768 Details.exe Details.exe PID 1768 wrote to memory of 1292 1768 Details.exe Details.exe PID 1768 wrote to memory of 1292 1768 Details.exe Details.exe PID 1768 wrote to memory of 1292 1768 Details.exe Details.exe PID 1768 wrote to memory of 1292 1768 Details.exe Details.exe PID 1768 wrote to memory of 1292 1768 Details.exe Details.exe PID 1768 wrote to memory of 1292 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe PID 1768 wrote to memory of 1900 1768 Details.exe Details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Details.exe"C:\Users\Admin\AppData\Local\Temp\Details.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Details.exeC:\Users\Admin\AppData\Local\Temp\Details.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Details.exeC:\Users\Admin\AppData\Local\Temp\Details.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Details.exeC:\Users\Admin\AppData\Local\Temp\Details.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Details.exeC:\Users\Admin\AppData\Local\Temp\Details.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1768-53-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/1768-55-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/1768-56-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/1768-57-0x0000000005A30000-0x0000000005B08000-memory.dmpFilesize
864KB
-
memory/1768-58-0x0000000000460000-0x0000000000481000-memory.dmpFilesize
132KB
-
memory/1900-60-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1900-61-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1900-63-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1900-62-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1900-59-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1900-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1900-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1900-66-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1900-67-0x000000000040242D-mapping.dmp
-
memory/1900-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB