Analysis
-
max time kernel
112s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 07:08
General
-
Target
3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a.exe
-
Size
1.1MB
-
MD5
98d3c0dde3018455aeac6aca14acafea
-
SHA1
0060ca9137a052d2e954b0d62112bb8b72e0ba94
-
SHA256
3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a
-
SHA512
6b8da7f8f591d937f7288e42d86c2bdb6c7d83fc0f89c48d5a675578d1fe90f0416b73bea1df76492bdc4085f91a593d577077ecb9b6fc135bee6ac390834fb6
Malware Config
Extracted
netwire
185.208.211.218:8090
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 5 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a.exe"C:\Users\Admin\AppData\Local\Temp\3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a.exe"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
44KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB