Analysis
-
max time kernel
92s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
18-10-2021 11:30
Static task
static1
Behavioral task
behavioral1
Sample
Details.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Details.exe
Resource
win10-en-20211014
General
-
Target
Details.exe
-
Size
123KB
-
MD5
a6d253e02a22e26939f3d775ee1127cd
-
SHA1
a8e827a9c4916a4b85e5e783764173df0dadd116
-
SHA256
61722636c5cad31d212e7ea1da55d4fde3a7e93fc46f81484dd7597a684a8164
-
SHA512
dc13d3e6a721cc2673663d0b70fcae92ed2316f4b247039dcdf8e6312a0525fc14209c4c1f860da3d04939095f1f7a912d60b20f0242dbf6ff95bc341eaada82
Malware Config
Extracted
netwire
213.152.162.181:5133
184.75.221.171:5133
199.249.230.27:5133
185.103.96.143:5133
185.104.184.43:5133
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
- install_path
- keylogger_dir
-
lock_executable
true
-
mutex
SeDCqQtm
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1316-120-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1316-121-0x000000000040242D-mapping.dmp netwire behavioral2/memory/1316-122-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Details.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\chrome.exe\"" Details.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Details.exedescription pid process target process PID 2360 set thread context of 1316 2360 Details.exe Details.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Details.exepid process 2360 Details.exe 2360 Details.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Details.exedescription pid process Token: SeDebugPrivilege 2360 Details.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Details.exedescription pid process target process PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe PID 2360 wrote to memory of 1316 2360 Details.exe Details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Details.exe"C:\Users\Admin\AppData\Local\Temp\Details.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Details.exeC:\Users\Admin\AppData\Local\Temp\Details.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1316-120-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1316-121-0x000000000040242D-mapping.dmp
-
memory/1316-122-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2360-115-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/2360-117-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/2360-118-0x0000000005FD0000-0x00000000060A8000-memory.dmpFilesize
864KB
-
memory/2360-119-0x00000000011D0000-0x00000000011F1000-memory.dmpFilesize
132KB