Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    11-07-2022 02:56

General

  • Target

    DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe

  • Size

    600KB

  • MD5

    b695909a4b4b1aba822856cf9b5c3654

  • SHA1

    2700da2718fc48ce83cd00bcb63a8c9673307e1a

  • SHA256

    df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0

  • SHA512

    f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3

Malware Config

Signatures

  • NetWire RAT payload 7 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe
    "C:\Users\Admin\AppData\Local\Temp\DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Users\Admin\AppData\Local\Temp\DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe
      "C:\Users\Admin\AppData\Local\Temp\DF3AE349E21A4C63465FDDB69D250CBB949FF24FF8D82.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
          4⤵
          • Executes dropped EXE
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:1968

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe

    Filesize

    600KB

    MD5

    b695909a4b4b1aba822856cf9b5c3654

    SHA1

    2700da2718fc48ce83cd00bcb63a8c9673307e1a

    SHA256

    df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0

    SHA512

    f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe

    Filesize

    600KB

    MD5

    b695909a4b4b1aba822856cf9b5c3654

    SHA1

    2700da2718fc48ce83cd00bcb63a8c9673307e1a

    SHA256

    df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0

    SHA512

    f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe

    Filesize

    600KB

    MD5

    b695909a4b4b1aba822856cf9b5c3654

    SHA1

    2700da2718fc48ce83cd00bcb63a8c9673307e1a

    SHA256

    df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0

    SHA512

    f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3

  • \Users\Admin\AppData\Roaming\Install\Host.exe

    Filesize

    600KB

    MD5

    b695909a4b4b1aba822856cf9b5c3654

    SHA1

    2700da2718fc48ce83cd00bcb63a8c9673307e1a

    SHA256

    df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0

    SHA512

    f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3

  • \Users\Admin\AppData\Roaming\Install\Host.exe

    Filesize

    600KB

    MD5

    b695909a4b4b1aba822856cf9b5c3654

    SHA1

    2700da2718fc48ce83cd00bcb63a8c9673307e1a

    SHA256

    df3ae349e21a4c63465fddb69d250cbb949ff24ff8d82592013ab93e330519d0

    SHA512

    f44ebb1c41dd06e6cba3f9636ddee4815fb3a2ccbf94ff6a08d1843321044bfd9b3968545bceead6c6402d4a1c1d7cad54608bc6ab54de7af3de033b62c7baf3

  • memory/912-57-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

    Filesize

    8KB

  • memory/912-59-0x0000000077060000-0x0000000077209000-memory.dmp

    Filesize

    1.7MB

  • memory/912-60-0x0000000077240000-0x00000000773C0000-memory.dmp

    Filesize

    1.5MB

  • memory/912-62-0x0000000000240000-0x000000000024F000-memory.dmp

    Filesize

    60KB

  • memory/912-63-0x0000000077240000-0x00000000773C0000-memory.dmp

    Filesize

    1.5MB

  • memory/912-56-0x0000000000240000-0x000000000024F000-memory.dmp

    Filesize

    60KB

  • memory/1664-66-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/1664-67-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/1664-77-0x00000000001B0000-0x00000000001BF000-memory.dmp

    Filesize

    60KB

  • memory/1664-80-0x0000000077240000-0x00000000773C0000-memory.dmp

    Filesize

    1.5MB

  • memory/1664-81-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/1664-78-0x0000000077060000-0x0000000077209000-memory.dmp

    Filesize

    1.7MB

  • memory/1704-89-0x0000000077240000-0x00000000773C0000-memory.dmp

    Filesize

    1.5MB

  • memory/1704-85-0x0000000077060000-0x0000000077209000-memory.dmp

    Filesize

    1.7MB

  • memory/1968-92-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/1968-93-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/1968-99-0x0000000077060000-0x0000000077209000-memory.dmp

    Filesize

    1.7MB

  • memory/1968-100-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/1968-101-0x0000000000220000-0x000000000022F000-memory.dmp

    Filesize

    60KB

  • memory/1968-102-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB