Behavioral Report

General

Target

doc.exe
Size

882KB
MD5

95b5d76bfb2204011333248cc121b5a4
SHA1

6faea7983c34f12cec7d22184be0eb1693e0abaf
SHA256

849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e
SHA512

966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152
SSDEEP

12288:eP9sJ2iNZrmsAJVSsuTEa0nKYVNp1X8bX+r9k3RADqjJ5n5OiU0rZIG41r5XiXoT:ePiJ1rasmLNaGKgNb8+rEjr5G

Score

10^/10

Malware Config

Extracted

Family	netwire
C2	37.0.14.206:3384 37.0.14.206:3384
Attributes	activex_autorun false copy_executable true delete_original false host_id HostId-%Rand% install_path %AppData%\Install\Host.exe keylogger_dir %AppData%\Logs\ lock_executable true offline_keylogger true password Password234 registry_autorun false use_mutex false

Signatures

NetWire RAT payload ⋅ 6 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4312-140-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4312-142-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4312-146-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4408-155-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4408-156-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral2/memory/4408-157-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE ⋅ 3 IoCs

Processes:

Host.exeHost.exeHost.exe

pid process

2880 Host.exe
4972 Host.exe
4408 Host.exe

pid	process
2880	Host.exe
4972	Host.exe
4408	Host.exe

Checks computer location settings ⋅ 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

TTPs:

Query Registry System Information Discovery

Processes:

doc.exedoc.exeHost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	doc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	doc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Host.exe

Suspicious use of SetThreadContext ⋅ 2 IoCs

Processes:

doc.exeHost.exe

description pid process target process

PID 4788 set thread context of 4312 4788 doc.exe doc.exe
PID 2880 set thread context of 4408 2880 Host.exe Host.exe
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs:

System Information Discovery
Creates scheduled task(s) ⋅ 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

TTPs:

Scheduled Task

Processes:

schtasks.exeschtasks.exe

pid process

2240 schtasks.exe
4592 schtasks.exe
Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs

Processes:

doc.exeHost.exe

pid process

4788 doc.exe
2880 Host.exe
2880 Host.exe
2880 Host.exe
Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs

Processes:

doc.exeHost.exe

description pid process

Token: SeDebugPrivilege 4788 doc.exe
Token: SeDebugPrivilege 2880 Host.exe

description	pid	process	target process
PID 4788 set thread context of 4312	4788	doc.exe	doc.exe
PID 2880 set thread context of 4408	2880	Host.exe	Host.exe

pid	process
2240	schtasks.exe
4592	schtasks.exe

pid	process
4788	doc.exe
2880	Host.exe
2880	Host.exe
2880	Host.exe

description	pid	process
Token: SeDebugPrivilege	4788	doc.exe
Token: SeDebugPrivilege	2880	Host.exe

Suspicious use of WriteProcessMemory ⋅ 34 IoCs

Processes:

doc.exedoc.exeHost.exe

description	pid	process	target process
PID 4788 wrote to memory of 2240	4788	doc.exe	schtasks.exe
PID 4788 wrote to memory of 2240	4788	doc.exe	schtasks.exe
PID 4788 wrote to memory of 2240	4788	doc.exe	schtasks.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4788 wrote to memory of 4312	4788	doc.exe	doc.exe
PID 4312 wrote to memory of 2880	4312	doc.exe	Host.exe
PID 4312 wrote to memory of 2880	4312	doc.exe	Host.exe
PID 4312 wrote to memory of 2880	4312	doc.exe	Host.exe
PID 2880 wrote to memory of 4592	2880	Host.exe	schtasks.exe
PID 2880 wrote to memory of 4592	2880	Host.exe	schtasks.exe
PID 2880 wrote to memory of 4592	2880	Host.exe	schtasks.exe
PID 2880 wrote to memory of 4972	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4972	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4972	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe
PID 2880 wrote to memory of 4408	2880	Host.exe	Host.exe

C:\Users\Admin\AppData\Local\Temp\doc.exe

"C:\Users\Admin\AppData\Local\Temp\doc.exe"

Checks computer location settings
Suspicious use of SetThreadContext
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory

PID:4788

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5890.tmp"

Creates scheduled task(s)

PID:2240

C:\Users\Admin\AppData\Local\Temp\doc.exe

"{path}"

Checks computer location settings
Suspicious use of WriteProcessMemory

PID:4312

C:\Users\Admin\AppData\Roaming\Install\Host.exe

"C:\Users\Admin\AppData\Roaming\Install\Host.exe"

Executes dropped EXE
Checks computer location settings
Suspicious use of SetThreadContext
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory

PID:2880

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5A2.tmp"

Creates scheduled task(s)

PID:4592

C:\Users\Admin\AppData\Roaming\Install\Host.exe

"{path}"

Executes dropped EXE

PID:4972

C:\Users\Admin\AppData\Roaming\Install\Host.exe

"{path}"

Executes dropped EXE

PID:4408

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Scheduled Task

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5890.tmp
MD5
8bd18c65571655407e9122d3099d8330

SHA1
54e26b7b31c985196e170708dd19f8b0572c2f35

SHA256
8ee3a0a1727c6a7a7e0075e33db373b0532433116cdd1aa62b7208fcc4d83a13

SHA512
30582cf3c526d2f3fd88bbdb820ab6e77aff4f46c7328771a7904f16684e36390cc108c7ca9c0a5e1af001d474b9749629c5396c432b99d40d0ad39625bf6274

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC5A2.tmp
MD5
8bd18c65571655407e9122d3099d8330

SHA1
54e26b7b31c985196e170708dd19f8b0572c2f35

SHA256
8ee3a0a1727c6a7a7e0075e33db373b0532433116cdd1aa62b7208fcc4d83a13

SHA512
30582cf3c526d2f3fd88bbdb820ab6e77aff4f46c7328771a7904f16684e36390cc108c7ca9c0a5e1af001d474b9749629c5396c432b99d40d0ad39625bf6274

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
95b5d76bfb2204011333248cc121b5a4

SHA1
6faea7983c34f12cec7d22184be0eb1693e0abaf

SHA256
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

SHA512
966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
95b5d76bfb2204011333248cc121b5a4

SHA1
6faea7983c34f12cec7d22184be0eb1693e0abaf

SHA256
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

SHA512
966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
95b5d76bfb2204011333248cc121b5a4

SHA1
6faea7983c34f12cec7d22184be0eb1693e0abaf

SHA256
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

SHA512
966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

Download Submit
C:\Users\Admin\AppData\Roaming\Install\Host.exe
MD5
95b5d76bfb2204011333248cc121b5a4

SHA1
6faea7983c34f12cec7d22184be0eb1693e0abaf

SHA256
849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

SHA512
966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

Download Submit
memory/2240-137-0x0000000000000000-mapping.dmp

Download
memory/2880-143-0x0000000000000000-mapping.dmp

Download
memory/4312-140-0x0000000000400000-0x0000000000433000-memory.dmp

Download
memory/4312-142-0x0000000000400000-0x0000000000433000-memory.dmp

Download
memory/4312-146-0x0000000000400000-0x0000000000433000-memory.dmp

Download
memory/4312-139-0x0000000000000000-mapping.dmp

Download
memory/4408-151-0x0000000000000000-mapping.dmp

Download
memory/4408-157-0x0000000000400000-0x0000000000433000-memory.dmp

Download
memory/4408-156-0x0000000000400000-0x0000000000433000-memory.dmp

Download
memory/4408-155-0x0000000000400000-0x0000000000433000-memory.dmp

Download
memory/4592-147-0x0000000000000000-mapping.dmp

Download
memory/4788-135-0x00000000054F0000-0x000000000558C000-memory.dmp

Download
memory/4788-134-0x0000000005450000-0x00000000054E2000-memory.dmp

Download
memory/4788-133-0x0000000005960000-0x0000000005F04000-memory.dmp

Download
memory/4788-136-0x0000000005430000-0x000000000543A000-memory.dmp

Download
memory/4788-132-0x0000000000960000-0x0000000000A42000-memory.dmp

Download
memory/4972-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Downloads