Overview

overview

10

Static

static

5

3c8a489d9e...5a.exe

windows7_x64

10

3c8a489d9e...5a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    03-07-2022 07:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a.exe

  • Size

    1.1MB

  • MD5

    98d3c0dde3018455aeac6aca14acafea

  • SHA1

    0060ca9137a052d2e954b0d62112bb8b72e0ba94

  • SHA256

    3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a

  • SHA512

    6b8da7f8f591d937f7288e42d86c2bdb6c7d83fc0f89c48d5a675578d1fe90f0416b73bea1df76492bdc4085f91a593d577077ecb9b6fc135bee6ac390834fb6

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

185.208.211.218:8090

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 2 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a.exe
    "C:\Users\Admin\AppData\Local\Temp\3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a.exe"
    1⤵
      PID:2148

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2148-130-0x0000000004480000-0x00000000044B6000-memory.dmp
      Filesize

      216KB

      Download
    • memory/2148-131-0x0000000004480000-0x00000000044B6000-memory.dmp
      Filesize

      216KB

      Download
    • memory/2148-132-0x0000000004480000-0x00000000044B6000-memory.dmp
      Filesize

      216KB

      Download
    • memory/2148-133-0x0000000004480000-0x00000000044B6000-memory.dmp
      Filesize

      216KB

      Download
    • memory/2148-134-0x0000000004480000-0x00000000044B6000-memory.dmp
      Filesize

      216KB

      Download
    • memory/2148-135-0x0000000004481000-0x000000000448C000-memory.dmp
      Filesize

      44KB

      Download
    • memory/2148-136-0x0000000004810000-0x000000000483C000-memory.dmp
      Filesize

      176KB

      Download