Analysis
- max time kernel
60s - max time network
64s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
27/02/2022, 10:43
General
- Target Kasım Fatura kopyası.exe
- Size 624KB
- Sample220227-msgtasddfl
- SHA256 29bd4d55cb24fd04eabdc27eabcabe11f348ed1fc60b4c066af3be4c5eed869c
Score
10/10
Malware Config
Extracted
Family
-
netwire
C2
-
cash001.duckdns.org:3360
Attributes
-
activex_autorun
true
-
activex_key
{66E2SHG3-33KN-A7CW-7LD8-00AJ03SLXEYU}
-
copy_executable
true
-
delete_original
false
-
host_id
prick
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
gbam1234
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
- NetWire RAT payload 2 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Modifies Installed Components in the registry 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kasım Fatura kopyası.exe"C:\Users\Admin\AppData\Local\Temp\Kasım Fatura kopyası.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Kasım Fatura kopyası.exe"C:\Users\Admin\AppData\Local\Temp\Kasım Fatura kopyası.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1148-135-0x0000000000400000-0x000000000049D000-memory.dmp
memory/1148-137-0x0000000000400000-0x0000000000425000-memory.dmp
memory/1148-140-0x0000000000401000-0x0000000000417000-memory.dmp
memory/2692-132-0x00000000029C0000-0x00000000029CF000-memory.dmp
memory/2692-133-0x00007FF919671000-0x00007FF91978A000-memory.dmp
memory/2692-134-0x0000000077BE1000-0x0000000077D01000-memory.dmp