Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-10-2022 07:38

General

  • Target

    95b5d76bfb2204011333248cc121b5a4.exe

  • Size

    882KB

  • MD5

    95b5d76bfb2204011333248cc121b5a4

  • SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

  • SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

  • SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • SSDEEP

    12288:eP9sJ2iNZrmsAJVSsuTEa0nKYVNp1X8bX+r9k3RADqjJ5n5OiU0rZIG41r5XiXoT:ePiJ1rasmLNaGKgNb8+rEjr5G

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes
activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

  • NetWire RAT payload ⋅ 11 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE ⋅ 3 IoCs
  • Loads dropped DLL ⋅ 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 3 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe
    "C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD2DA.tmp"
      Creates scheduled task(s)
      PID:1364
    • C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe
      "{path}"
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:904
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp40F7.tmp"
          Creates scheduled task(s)
          PID:948
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "{path}"
          Executes dropped EXE
          PID:1916
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "{path}"
          Executes dropped EXE
          PID:1564

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\tmp40F7.tmp
                        MD5

                        ccf8d675a087286bae70e5689659724d

                        SHA1

                        f6b2320f5b9ebaae8c0888863445f113bac87e8b

                        SHA256

                        20180598a06f709bdd05018e594cd4e032cdaf415332a751623f0a614501671e

                        SHA512

                        7bbcd2f3447285f0ba1cbcec18fd15f833076089855ddcba2b3cc05d8127cad9785b70a05d173bbd37b7712ae77b5636714e0394e2ad4eb7144b93d60a1cc55a

                      • C:\Users\Admin\AppData\Local\Temp\tmpD2DA.tmp
                        MD5

                        ccf8d675a087286bae70e5689659724d

                        SHA1

                        f6b2320f5b9ebaae8c0888863445f113bac87e8b

                        SHA256

                        20180598a06f709bdd05018e594cd4e032cdaf415332a751623f0a614501671e

                        SHA512

                        7bbcd2f3447285f0ba1cbcec18fd15f833076089855ddcba2b3cc05d8127cad9785b70a05d173bbd37b7712ae77b5636714e0394e2ad4eb7144b93d60a1cc55a

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • \Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • memory/904-81-0x0000000000920000-0x0000000000A02000-memory.dmp
                      • memory/904-77-0x0000000000000000-mapping.dmp
                      • memory/948-83-0x0000000000000000-mapping.dmp
                      • memory/1360-61-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1360-62-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1360-68-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1360-70-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1360-71-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1360-72-0x000000000040242D-mapping.dmp
                      • memory/1360-75-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1360-66-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1360-64-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1360-67-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1360-79-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1364-59-0x0000000000000000-mapping.dmp
                      • memory/1564-97-0x000000000040242D-mapping.dmp
                      • memory/1564-101-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1564-102-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/1992-54-0x0000000000B80000-0x0000000000C62000-memory.dmp
                      • memory/1992-58-0x0000000000730000-0x000000000075E000-memory.dmp
                      • memory/1992-57-0x00000000051A0000-0x000000000521E000-memory.dmp
                      • memory/1992-56-0x00000000005D0000-0x00000000005F0000-memory.dmp
                      • memory/1992-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp