Analysis
-
max time kernel
103s -
max time network
107s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
-
submitted
31-07-2022 09:55
General
-
Target
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe
-
Size
159KB
-
MD5
389eb42409ce5da14af2311a26a1e8cf
-
SHA1
0e2305cc75cf934521243b162b1b7f260407e0db
-
SHA256
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9
-
SHA512
45a944f6d7974e406e119e5a73b956821ccf96fe4b999cf8a351105215d27491fcd1ec6489be065f8b04f69698b758ef1302dc62699613962cd5863b096ab382
Score
10/10
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Drops startup file 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe"C:\Users\Admin\AppData\Local\Temp\a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1972-56-0x00000000004026D0-mapping.dmp
-
memory/1972-58-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1972-59-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2024-54-0x00000000002C0000-0x00000000002C5000-memory.dmpFilesize
20KB
-
memory/2024-55-0x0000000075731000-0x0000000075733000-memory.dmpFilesize
8KB