Analysis

  • max time kernel
    59s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    30-09-2022 09:34

General

  • Target

    doc.exe

  • Size

    882KB

  • MD5

    95b5d76bfb2204011333248cc121b5a4

  • SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

  • SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

  • SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • SSDEEP

    12288:eP9sJ2iNZrmsAJVSsuTEa0nKYVNp1X8bX+r9k3RADqjJ5n5OiU0rZIG41r5XiXoT:ePiJ1rasmLNaGKgNb8+rEjr5G

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes
activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

  • NetWire RAT payload ⋅ 11 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE ⋅ 2 IoCs
  • Loads dropped DLL ⋅ 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\doc.exe
    "C:\Users\Admin\AppData\Local\Temp\doc.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp72EF.tmp"
      Creates scheduled task(s)
      PID:1608
    • C:\Users\Admin\AppData\Local\Temp\doc.exe
      "{path}"
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:628
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:1240
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE2C2.tmp"
          Creates scheduled task(s)
          PID:1508
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "{path}"
          Executes dropped EXE
          PID:2012

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\tmp72EF.tmp
                        MD5

                        72ca22c81d80aba39e4f2fd7c1557e5a

                        SHA1

                        95c2c5b8f2129f6fda30c329315330aed4830cac

                        SHA256

                        aef341fc99fe4c10e688aa4ca1b61a4b2bb732854ccb522e70e1a2b700c28bee

                        SHA512

                        1f6ed35d5f185f678f5b675a8ece380f462b072cb35c655bc18d706bf8bffe616cec7fc17278be424ec31adde459910f83b4f6cedc719cfa53d99d34cab81ea2

                      • C:\Users\Admin\AppData\Local\Temp\tmpE2C2.tmp
                        MD5

                        72ca22c81d80aba39e4f2fd7c1557e5a

                        SHA1

                        95c2c5b8f2129f6fda30c329315330aed4830cac

                        SHA256

                        aef341fc99fe4c10e688aa4ca1b61a4b2bb732854ccb522e70e1a2b700c28bee

                        SHA512

                        1f6ed35d5f185f678f5b675a8ece380f462b072cb35c655bc18d706bf8bffe616cec7fc17278be424ec31adde459910f83b4f6cedc719cfa53d99d34cab81ea2

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • \Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • memory/628-71-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/628-70-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/628-62-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/628-64-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/628-66-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/628-67-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/628-68-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/628-61-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/628-79-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/628-72-0x000000000040242D-mapping.dmp
                      • memory/628-75-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1064-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp
                      • memory/1064-56-0x0000000000320000-0x0000000000340000-memory.dmp
                      • memory/1064-58-0x00000000008D0000-0x00000000008FE000-memory.dmp
                      • memory/1064-57-0x00000000053D0000-0x000000000544E000-memory.dmp
                      • memory/1064-54-0x00000000001E0000-0x00000000002C2000-memory.dmp
                      • memory/1240-81-0x0000000000A60000-0x0000000000B42000-memory.dmp
                      • memory/1240-77-0x0000000000000000-mapping.dmp
                      • memory/1508-83-0x0000000000000000-mapping.dmp
                      • memory/1608-59-0x0000000000000000-mapping.dmp
                      • memory/2012-96-0x000000000040242D-mapping.dmp
                      • memory/2012-100-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/2012-101-0x0000000000400000-0x0000000000433000-memory.dmp