Analysis

  • max time kernel
    151s
  • max time network
    172s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-07-2022 06:58

General

  • Target

    4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895.exe

  • Size

    303KB

  • MD5

    144539a65d10a6ed3df334866028ba79

  • SHA1

    7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

  • SHA256

    4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

  • SHA512

    33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

Malware Config

Extracted

Family

netwire

C2

info1.nowddns.com:5552

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    NOW-DNS-5552

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    gqmQdKHu

  • offline_keylogger

    true

  • password

    caster123

  • registry_autorun

    false

  • use_mutex

    true

Signatures

  • NetWire RAT payload 7 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 3 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895.exe
    "C:\Users\Admin\AppData\Local\Temp\4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe"
      2⤵
        PID:1616
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe"
          3⤵
          • Executes dropped EXE
          • Drops startup file
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:952
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1152
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe"
              5⤵
              • Executes dropped EXE
              PID:1272
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 1508
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:1816

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\app.exe

      Filesize

      303KB

      MD5

      144539a65d10a6ed3df334866028ba79

      SHA1

      7d74cbaa4552b9468aaf079dab28b2bae29d1ae9

      SHA256

      4114804fd7aebc04caec60731b3282998cca1e276e5f120dce88d46decff1895

      SHA512

      33802b04f713820d4a19220b3391cde8090a3837a82fff2d23af4d8994998665d87c98195170f68b6856c58d765b96bfd64fa7163ee1cf3882416cb5de8c58e9

    • memory/952-65-0x0000000000270000-0x00000000002C4000-memory.dmp

      Filesize

      336KB

    • memory/952-66-0x00000000004F0000-0x0000000000514000-memory.dmp

      Filesize

      144KB

    • memory/1152-70-0x00000000003C0000-0x00000000003CC000-memory.dmp

      Filesize

      48KB

    • memory/1152-69-0x0000000000250000-0x0000000000274000-memory.dmp

      Filesize

      144KB

    • memory/1272-86-0x00000000000C0000-0x00000000000EC000-memory.dmp

      Filesize

      176KB

    • memory/1272-98-0x00000000000C0000-0x00000000000EC000-memory.dmp

      Filesize

      176KB

    • memory/1272-90-0x00000000000C0000-0x00000000000EC000-memory.dmp

      Filesize

      176KB

    • memory/1272-93-0x00000000000C0000-0x00000000000EC000-memory.dmp

      Filesize

      176KB

    • memory/1272-78-0x00000000000C0000-0x00000000000EC000-memory.dmp

      Filesize

      176KB

    • memory/1272-79-0x00000000000C0000-0x00000000000EC000-memory.dmp

      Filesize

      176KB

    • memory/1272-81-0x00000000000C0000-0x00000000000EC000-memory.dmp

      Filesize

      176KB

    • memory/1272-83-0x00000000000C0000-0x00000000000EC000-memory.dmp

      Filesize

      176KB

    • memory/1272-84-0x00000000000C0000-0x00000000000EC000-memory.dmp

      Filesize

      176KB

    • memory/1764-57-0x0000000000550000-0x000000000055A000-memory.dmp

      Filesize

      40KB

    • memory/1764-54-0x0000000001290000-0x00000000012E4000-memory.dmp

      Filesize

      336KB

    • memory/1764-56-0x00000000003E0000-0x0000000000404000-memory.dmp

      Filesize

      144KB

    • memory/1764-55-0x00000000002F0000-0x000000000031C000-memory.dmp

      Filesize

      176KB

    • memory/1764-58-0x0000000075B71000-0x0000000075B73000-memory.dmp

      Filesize

      8KB