Analysis
- max time kernel
133s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
22/02/2022, 15:23
General
- Target 17e3fd00f747ce812f7c462effd06f149541bc21830dd19c114e551cae0719b3.exe
- Size 1.2MB
- Sample220222-ssqzvsade7
- SHA256 17e3fd00f747ce812f7c462effd06f149541bc21830dd19c114e551cae0719b3
Score
10/10
Malware Config
Extracted
Family
-
netwire
C2
-
cobroserfinansa.com:58460
Attributes
-
activex_autorun
true
-
activex_key
{D4AEAYNR-V1T0-E43Q-82LB-O6JF320BN6SI}
-
copy_executable
true
-
delete_original
false
-
host_id
Bancos
-
install_path
%AppData%\Install\winlogon.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
hkggpbgo
-
offline_keylogger
true
-
password
1234561a1234561a
-
registry_autorun
true
-
startup_name
HKLM
-
use_mutex
true
Signatures
- NetWire RAT payload 1 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Drops file in Windows directory 1 IoCs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17e3fd00f747ce812f7c462effd06f149541bc21830dd19c114e551cae0719b3.exe"C:\Users\Admin\AppData\Local\Temp\17e3fd00f747ce812f7c462effd06f149541bc21830dd19c114e551cae0719b3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\17e3fd00f747ce812f7c462effd06f149541bc21830dd19c114e551cae0719b3.exe"C:\Users\Admin\AppData\Local\Temp\17e3fd00f747ce812f7c462effd06f149541bc21830dd19c114e551cae0719b3.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 3163⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1128 -ip 11281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/372-134-0x0000000077052000-0x0000000077053000-memory.dmp
memory/372-133-0x0000000002420000-0x000000000249B000-memory.dmp
memory/1128-136-0x0000000000010000-0x0000000000011000-memory.dmp
memory/1128-135-0x0000000077052000-0x0000000077053000-memory.dmp
memory/1128-137-0x0000000000400000-0x0000000000425000-memory.dmp