Overview

overview

10

Static

static

Details.exe

windows7_x64

10

Details.exe

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    18-10-2021 14:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Details.exe

  • Size

    123KB

  • MD5

    a6d253e02a22e26939f3d775ee1127cd

  • SHA1

    a8e827a9c4916a4b85e5e783764173df0dadd116

  • SHA256

    61722636c5cad31d212e7ea1da55d4fde3a7e93fc46f81484dd7597a684a8164

  • SHA512

    dc13d3e6a721cc2673663d0b70fcae92ed2316f4b247039dcdf8e6312a0525fc14209c4c1f860da3d04939095f1f7a912d60b20f0242dbf6ff95bc341eaada82

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

213.152.162.181:5133

184.75.221.171:5133

199.249.230.27:5133

185.103.96.143:5133

185.104.184.43:5133
Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

  • keylogger_dir

  • lock_executable

    true

  • mutex

    SeDCqQtm

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • startup_name

  • use_mutex

    true

Signatures

  • NetWire RAT payload 7 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Details.exe
    "C:\Users\Admin\AppData\Local\Temp\Details.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\Details.exe
      C:\Users\Admin\AppData\Local\Temp\Details.exe
      2⤵
        PID:920

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/920-66-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/920-63-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/920-70-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/920-68-0x000000000040242D-mapping.dmp
      Download
    • memory/920-67-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/920-60-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/920-61-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/920-65-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/920-62-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/920-64-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/2024-54-0x00000000010B0000-0x00000000010B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2024-56-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2024-59-0x0000000000750000-0x0000000000771000-memory.dmp
      Filesize

      132KB

      Download
    • memory/2024-58-0x0000000005910000-0x00000000059E8000-memory.dmp
      Filesize

      864KB

      Download
    • memory/2024-57-0x0000000075B71000-0x0000000075B73000-memory.dmp
      Filesize

      8KB

      Download