Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 18:26
Static task
static1
Behavioral task
behavioral1
Sample
?????? ???????.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
?????? ???????.exe
-
Size
1.1MB
-
MD5
078e87a6f5ff6b6b704a123fc7214472
-
SHA1
b2e08a685ef595582d7b3579066ba5172ae97293
-
SHA256
cf3b59c22659d7931cf9d0338d57af01d63fbb8363ebc4c86be884194ef62e40
-
SHA512
5da4e95e827ce1a34f5d04da9699395853d6f2f8ec3ce951ed9b0caa0820686e98d3c31ed833d71158da27109f44645a2f834f334691fd4a7a53ce23caebd21f
Malware Config
Extracted
Family
netwire
C2
justhungry.theworkpc.com:3367
Attributes
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
test
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
mutex
rXrItmjS
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4276-131-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4276-143-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Drops startup file 1 IoCs
Processes:
______ _______.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppContracts.url ______ _______.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
______ _______.exedescription pid process target process PID 568 set thread context of 4276 568 ______ _______.exe ______ _______.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
______ _______.exepid process 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
______ _______.exepid process 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
______ _______.exepid process 568 ______ _______.exe 568 ______ _______.exe 568 ______ _______.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
______ _______.exedescription pid process target process PID 568 wrote to memory of 4276 568 ______ _______.exe ______ _______.exe PID 568 wrote to memory of 4276 568 ______ _______.exe ______ _______.exe PID 568 wrote to memory of 4276 568 ______ _______.exe ______ _______.exe PID 568 wrote to memory of 4276 568 ______ _______.exe ______ _______.exe PID 568 wrote to memory of 4276 568 ______ _______.exe ______ _______.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\______ _______.exe"C:\Users\Admin\AppData\Local\Temp\______ _______.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\______ _______.exe"C:\Users\Admin\AppData\Local\Temp\______ _______.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/568-140-0x0000000003C00000-0x0000000003C51000-memory.dmpFilesize
324KB
-
memory/568-142-0x0000000004710000-0x0000000004761000-memory.dmpFilesize
324KB
-
memory/4276-130-0x0000000000000000-mapping.dmp
-
memory/4276-131-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4276-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB