Analysis
- max time kernel
118s - max time network
128s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
06/03/2022, 21:31
General
- Target af6213dbe89af70178e99cf16b51a7326664cfc585275b3cbda5ec397a75d1aa.exe
- Size 440KB
- Sample220306-1c4vsahadj
- SHA256 af6213dbe89af70178e99cf16b51a7326664cfc585275b3cbda5ec397a75d1aa
Malware Config
Signatures
- NetWire RAT payload 1 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\af6213dbe89af70178e99cf16b51a7326664cfc585275b3cbda5ec397a75d1aa.exe"C:\Users\Admin\AppData\Local\Temp\af6213dbe89af70178e99cf16b51a7326664cfc585275b3cbda5ec397a75d1aa.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1188-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmp
memory/1188-56-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-57-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-59-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-81-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-79-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-77-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-75-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-73-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-71-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-69-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-67-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-65-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-63-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-61-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-83-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-99-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-97-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-95-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-93-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-91-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-89-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-101-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-87-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-85-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-103-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-105-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-107-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-110-0x00000000002C9000-0x00000000002CA000-memory.dmp
memory/1188-109-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-112-0x0000000077440000-0x00000000775C0000-memory.dmp
memory/1188-114-0x0000000077440000-0x00000000775C0000-memory.dmp
memory/1188-113-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-116-0x0000000077440000-0x00000000775C0000-memory.dmp
memory/1188-117-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-120-0x00000000002D0000-0x00000000002D1000-memory.dmp
memory/1188-118-0x0000000077440000-0x00000000775C0000-memory.dmp
memory/1188-122-0x0000000077440000-0x00000000775C0000-memory.dmp
memory/1188-121-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-126-0x0000000077440000-0x00000000775C0000-memory.dmp
memory/1188-125-0x0000000000290000-0x00000000002F5000-memory.dmp
memory/1188-124-0x00000000002D3000-0x00000000002D4000-memory.dmp
memory/1188-154-0x0000000077440000-0x00000000775C0000-memory.dmp
memory/1188-234-0x00000000002CD000-0x00000000002CE000-memory.dmp
memory/1188-235-0x00000000002CA000-0x00000000002CB000-memory.dmp
memory/1188-236-0x0000000000400000-0x0000000000425000-memory.dmp