Analysis
-
max time kernel
101s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
-
submitted
25-07-2022 09:53
General
-
Target
SecuriteInfo.com.Trojan.Mardom.MN.10.9492.exe
-
Size
412KB
-
MD5
afa993ae036de690642a6275a3053ede
-
SHA1
b2bdb616a2f6b8eb2c59340ede249e1b109ba5e7
-
SHA256
214751a0d73e0aa9a6f5c010fd3c4fd45d5a2e4f96db8c2875355c399ff3a5bc
-
SHA512
a1f7737a09762d69383db25e32284b1682d71c974767329537e10873703bc0ec2ac4ef310dd53633efc74f498dc2ceef78de9196f12a9039a3a5daf36633a36b
Score
10/10
Malware Config
Extracted
Family
netwire
C2
194.5.98.178:3384
194.5.98.178:3385
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
lovewin1
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.10.9492.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.10.9492.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.10.9492.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.10.9492.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
-
Filesize
8KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
-
Filesize
204KB
-
Filesize
204KB