Analysis
- max time kernel
146s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
29/04/2022, 09:49
General
- Target SecuriteInfo.com.ArtemisEA8825EC387A.4124.exe
- Size 1.0MB
- Sample220429-ltb4rsedej
- SHA256 f4ec04cb1edb890bbc61499cb05c08c097af275e92c4902e82cac60b2a244f71
Malware Config
Extracted
-
netwire
-
194.36.111.59:5839
-
213.152.161.249:5839
-
184.75.221.115:5839
-
217.151.98.163:5839
-
37.120.217.243:5839
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-MoW4C4
-
lock_executable
true
-
mutex
pXrskrNe
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
true
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- NetWire RAT payload 2 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- ModiLoader Second Stage 39 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisEA8825EC387A.4124.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisEA8825EC387A.4124.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\Whwajyot.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\WhwajyoO.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Cdex.bat
WhwajyoO.bat
Whwajyot.bat
memory/2432-212-0x0000000010550000-0x0000000010585000-memory.dmp
memory/2432-213-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3420-162-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-144-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-150-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-149-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-151-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-152-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-154-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-153-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-155-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-157-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-156-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-158-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-160-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-159-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-161-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-147-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-163-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-164-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-165-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-148-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-146-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-145-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-142-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-143-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-140-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-141-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-211-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-209-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-210-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-208-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-207-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-206-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-205-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-204-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-196-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-197-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-193-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-195-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-194-0x0000000003E60000-0x0000000003EB8000-memory.dmp
memory/3420-192-0x0000000010550000-0x0000000010585000-memory.dmp
memory/4220-181-0x0000000070180000-0x00000000701CC000-memory.dmp
memory/4220-179-0x0000000006670000-0x000000000668E000-memory.dmp
memory/4220-187-0x0000000007B90000-0x0000000007B9E000-memory.dmp
memory/4220-180-0x00000000077C0000-0x00000000077F2000-memory.dmp
memory/4220-185-0x00000000079E0000-0x00000000079EA000-memory.dmp
memory/4220-184-0x0000000007960000-0x000000000797A000-memory.dmp
memory/4220-183-0x0000000007FA0000-0x000000000861A000-memory.dmp
memory/4220-182-0x00000000077A0000-0x00000000077BE000-memory.dmp
memory/4220-189-0x0000000007C80000-0x0000000007C88000-memory.dmp
memory/4220-188-0x0000000007C90000-0x0000000007CAA000-memory.dmp
memory/4220-186-0x0000000007BD0000-0x0000000007C66000-memory.dmp
memory/4220-178-0x0000000006020000-0x0000000006086000-memory.dmp
memory/4220-177-0x0000000005FB0000-0x0000000006016000-memory.dmp
memory/4220-176-0x00000000057C0000-0x00000000057E2000-memory.dmp
memory/4220-175-0x0000000005850000-0x0000000005E78000-memory.dmp
memory/4220-174-0x00000000051E0000-0x0000000005216000-memory.dmp