Analysis

  • max time kernel
    91s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2022 09:34

General

  • Target

    doc.exe

  • Size

    882KB

  • MD5

    95b5d76bfb2204011333248cc121b5a4

  • SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

  • SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

  • SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • SSDEEP

    12288:eP9sJ2iNZrmsAJVSsuTEa0nKYVNp1X8bX+r9k3RADqjJ5n5OiU0rZIG41r5XiXoT:ePiJ1rasmLNaGKgNb8+rEjr5G

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes
activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

  • NetWire RAT payload ⋅ 6 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE ⋅ 3 IoCs
  • Checks computer location settings ⋅ 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\doc.exe
    "C:\Users\Admin\AppData\Local\Temp\doc.exe"
    Checks computer location settings
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5890.tmp"
      Creates scheduled task(s)
      PID:2240
    • C:\Users\Admin\AppData\Local\Temp\doc.exe
      "{path}"
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:2880
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5A2.tmp"
          Creates scheduled task(s)
          PID:4592
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "{path}"
          Executes dropped EXE
          PID:4972
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "{path}"
          Executes dropped EXE
          PID:4408

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\tmp5890.tmp
                        MD5

                        8bd18c65571655407e9122d3099d8330

                        SHA1

                        54e26b7b31c985196e170708dd19f8b0572c2f35

                        SHA256

                        8ee3a0a1727c6a7a7e0075e33db373b0532433116cdd1aa62b7208fcc4d83a13

                        SHA512

                        30582cf3c526d2f3fd88bbdb820ab6e77aff4f46c7328771a7904f16684e36390cc108c7ca9c0a5e1af001d474b9749629c5396c432b99d40d0ad39625bf6274

                      • C:\Users\Admin\AppData\Local\Temp\tmpC5A2.tmp
                        MD5

                        8bd18c65571655407e9122d3099d8330

                        SHA1

                        54e26b7b31c985196e170708dd19f8b0572c2f35

                        SHA256

                        8ee3a0a1727c6a7a7e0075e33db373b0532433116cdd1aa62b7208fcc4d83a13

                        SHA512

                        30582cf3c526d2f3fd88bbdb820ab6e77aff4f46c7328771a7904f16684e36390cc108c7ca9c0a5e1af001d474b9749629c5396c432b99d40d0ad39625bf6274

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • memory/2240-137-0x0000000000000000-mapping.dmp
                      • memory/2880-143-0x0000000000000000-mapping.dmp
                      • memory/4312-140-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/4312-142-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/4312-146-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/4312-139-0x0000000000000000-mapping.dmp
                      • memory/4408-151-0x0000000000000000-mapping.dmp
                      • memory/4408-157-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/4408-156-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/4408-155-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/4592-147-0x0000000000000000-mapping.dmp
                      • memory/4788-135-0x00000000054F0000-0x000000000558C000-memory.dmp
                      • memory/4788-134-0x0000000005450000-0x00000000054E2000-memory.dmp
                      • memory/4788-133-0x0000000005960000-0x0000000005F04000-memory.dmp
                      • memory/4788-136-0x0000000005430000-0x000000000543A000-memory.dmp
                      • memory/4788-132-0x0000000000960000-0x0000000000A42000-memory.dmp
                      • memory/4972-149-0x0000000000000000-mapping.dmp