Analysis
- max time kernel
60s - max time network
63s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
27/02/2022, 10:21
General
- Target Gozden gecirilmis fatura faturası.exe
- Size 596KB
- Sample220227-md5ltadddr
- SHA256 23cdc26c9b9000ab8c4815dc3bf816662c987a9632d54df7dd5130b88214ac6a
Score
10/10
Malware Config
Extracted
Family
-
netwire
C2
-
cash001.duckdns.org:3360
Attributes
-
activex_autorun
true
-
activex_key
{66E2SHG3-33KN-A7CW-7LD8-00AJ03SLXEYU}
-
copy_executable
true
-
delete_original
false
-
host_id
prick
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
gbam1234
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
- NetWire RAT payload 2 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Modifies Installed Components in the registry 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gozden gecirilmis fatura faturası.exe"C:\Users\Admin\AppData\Local\Temp\Gozden gecirilmis fatura faturası.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Gozden gecirilmis fatura faturası.exe"C:\Users\Admin\AppData\Local\Temp\Gozden gecirilmis fatura faturası.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/876-132-0x0000000002300000-0x000000000230F000-memory.dmp
memory/876-133-0x00007FF9C6F51000-0x00007FF9C706A000-memory.dmp
memory/876-134-0x0000000077891000-0x00000000779B1000-memory.dmp
memory/2328-135-0x0000000000400000-0x0000000000496000-memory.dmp
memory/2328-137-0x0000000000400000-0x0000000000425000-memory.dmp
memory/2328-140-0x0000000000401000-0x0000000000417000-memory.dmp