Analysis
-
max time kernel
112s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 07:08
Static task
static1
Behavioral task
behavioral1
Sample
3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a.exe
Resource
win7-20220414-en
General
-
Target
3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a.exe
-
Size
1.1MB
-
MD5
98d3c0dde3018455aeac6aca14acafea
-
SHA1
0060ca9137a052d2e954b0d62112bb8b72e0ba94
-
SHA256
3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a
-
SHA512
6b8da7f8f591d937f7288e42d86c2bdb6c7d83fc0f89c48d5a675578d1fe90f0416b73bea1df76492bdc4085f91a593d577077ecb9b6fc135bee6ac390834fb6
Malware Config
Extracted
netwire
185.208.211.218:8090
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1344-59-0x0000000000180000-0x00000000001B6000-memory.dmp netwire behavioral1/memory/1344-76-0x0000000000300000-0x000000000032C000-memory.dmp netwire behavioral1/memory/1344-77-0x0000000000300000-0x000000000032C000-memory.dmp netwire behavioral1/memory/1344-79-0x0000000000300000-0x000000000032C000-memory.dmp netwire behavioral1/memory/1344-80-0x0000000000300000-0x000000000032C000-memory.dmp netwire -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1344-54-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/1344-55-0x0000000000180000-0x00000000001B6000-memory.dmpFilesize
216KB
-
memory/1344-56-0x0000000000180000-0x00000000001B6000-memory.dmpFilesize
216KB
-
memory/1344-57-0x0000000000180000-0x00000000001B6000-memory.dmpFilesize
216KB
-
memory/1344-58-0x0000000000180000-0x00000000001B6000-memory.dmpFilesize
216KB
-
memory/1344-59-0x0000000000180000-0x00000000001B6000-memory.dmpFilesize
216KB
-
memory/1344-61-0x0000000003AB0000-0x0000000003C30000-memory.dmpFilesize
1.5MB
-
memory/1344-60-0x0000000003AB0000-0x0000000003C30000-memory.dmpFilesize
1.5MB
-
memory/1344-65-0x0000000003AB0000-0x0000000003C30000-memory.dmpFilesize
1.5MB
-
memory/1344-64-0x0000000000181000-0x000000000018C000-memory.dmpFilesize
44KB
-
memory/1344-63-0x0000000003AB0000-0x0000000003C30000-memory.dmpFilesize
1.5MB
-
memory/1344-67-0x0000000003AB0000-0x0000000003C30000-memory.dmpFilesize
1.5MB
-
memory/1344-69-0x0000000003AB0000-0x0000000003C30000-memory.dmpFilesize
1.5MB
-
memory/1344-71-0x0000000000300000-0x000000000032C000-memory.dmpFilesize
176KB
-
memory/1344-72-0x0000000000300000-0x000000000032C000-memory.dmpFilesize
176KB
-
memory/1344-74-0x0000000000300000-0x000000000032C000-memory.dmpFilesize
176KB
-
memory/1344-76-0x0000000000300000-0x000000000032C000-memory.dmpFilesize
176KB
-
memory/1344-77-0x0000000000300000-0x000000000032C000-memory.dmpFilesize
176KB
-
memory/1344-79-0x0000000000300000-0x000000000032C000-memory.dmpFilesize
176KB
-
memory/1344-80-0x0000000000300000-0x000000000032C000-memory.dmpFilesize
176KB