Analysis
-
max time kernel
139s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
resource tags
-
submitted
18-07-2022 05:59
General
-
Target
SVD0038847748.exe
-
Size
874KB
-
MD5
05ce79987f664577042435b819c74532
-
SHA1
cb1ff0222986e90b238a7020047c24fa3f85036a
-
SHA256
cf318f94ad9a7827d2cf4415549c9d3ceb92c0bae85c46e50420fbbe3fa8f3a4
-
SHA512
0d96b39f448e4eee8957cc11fba133a07378e6b68bbb1e0f0f739ecab53085611c0414eff9a41107cdc9eb4d471b37ec32f44130a005bfe285d4b8adca3629eb
Score
10/10
Malware Config
Extracted
Family
netwire
C2
xman2.duckdns.org:4433
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 7 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SVD0038847748.exe"C:\Users\Admin\AppData\Local\Temp\SVD0038847748.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SVD0038847748.exe"C:\Users\Admin\AppData\Local\Temp\SVD0038847748.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
512KB
-
Filesize
8KB
-
Filesize
896KB
-
Filesize
296KB
-
Filesize
40KB
-
Filesize
88KB