Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2022 07:38

General

  • Target

    95b5d76bfb2204011333248cc121b5a4.exe

  • Size

    882KB

  • MD5

    95b5d76bfb2204011333248cc121b5a4

  • SHA1

    6faea7983c34f12cec7d22184be0eb1693e0abaf

  • SHA256

    849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

  • SHA512

    966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

  • SSDEEP

    12288:eP9sJ2iNZrmsAJVSsuTEa0nKYVNp1X8bX+r9k3RADqjJ5n5OiU0rZIG41r5XiXoT:ePiJ1rasmLNaGKgNb8+rEjr5G

Malware Config

Extracted

Family

netwire

C2

37.0.14.206:3384

Attributes
activex_autorun
false
copy_executable
true
delete_original
false
host_id
HostId-%Rand%
install_path
%AppData%\Install\Host.exe
keylogger_dir
%AppData%\Logs\
lock_executable
true
offline_keylogger
true
password
Password234
registry_autorun
false
use_mutex
false

Signatures

  • NetWire RAT payload ⋅ 5 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE ⋅ 2 IoCs
  • Checks computer location settings ⋅ 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 8 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe
    "C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe"
    Checks computer location settings
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE94B.tmp"
      Creates scheduled task(s)
      PID:5080
    • C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe
      "{path}"
      PID:3932
    • C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe
      "{path}"
      PID:4652
    • C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe
      "{path}"
      PID:4124
    • C:\Users\Admin\AppData\Local\Temp\95b5d76bfb2204011333248cc121b5a4.exe
      "{path}"
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NksNHqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5360.tmp"
          Creates scheduled task(s)
          PID:3396
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "{path}"
          Executes dropped EXE
          PID:3108

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\tmp5360.tmp
                        MD5

                        65f892aa7144c7be9e9f0a64060f5f79

                        SHA1

                        33d937d86129a4c23affae32947812eb136fdacb

                        SHA256

                        fae46df3949c6dc59024f3dfbb59c659f1ea3f1ee8f6577a86da8f61af455d3c

                        SHA512

                        56585dce966d86b92a31e3384fe406b29a267da169efd8687552d3b927ddadb92579f83297866aeea394ac6c46abb3bd6cce605e9bd66c50091ff066024aca0f

                      • C:\Users\Admin\AppData\Local\Temp\tmpE94B.tmp
                        MD5

                        65f892aa7144c7be9e9f0a64060f5f79

                        SHA1

                        33d937d86129a4c23affae32947812eb136fdacb

                        SHA256

                        fae46df3949c6dc59024f3dfbb59c659f1ea3f1ee8f6577a86da8f61af455d3c

                        SHA512

                        56585dce966d86b92a31e3384fe406b29a267da169efd8687552d3b927ddadb92579f83297866aeea394ac6c46abb3bd6cce605e9bd66c50091ff066024aca0f

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
                        MD5

                        95b5d76bfb2204011333248cc121b5a4

                        SHA1

                        6faea7983c34f12cec7d22184be0eb1693e0abaf

                        SHA256

                        849590a841b815d047cfdadf4f430a64b8b1ac03518a0e1f18923662e7f4563e

                        SHA512

                        966343713d2174f09e1f5aa4493eb79bfca3b6504ff18253449e7a153c8a249f4a52e9d0a7e7319817b284fbaa80dff94e034772cc32fb3635457cbb1f3fc152

                      • memory/3108-156-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/3108-157-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/3108-152-0x0000000000000000-mapping.dmp
                      • memory/3356-136-0x0000000005960000-0x000000000596A000-memory.dmp
                      • memory/3356-135-0x0000000005A10000-0x0000000005AAC000-memory.dmp
                      • memory/3356-134-0x0000000005970000-0x0000000005A02000-memory.dmp
                      • memory/3356-133-0x0000000005E80000-0x0000000006424000-memory.dmp
                      • memory/3356-132-0x0000000000E80000-0x0000000000F62000-memory.dmp
                      • memory/3396-150-0x0000000000000000-mapping.dmp
                      • memory/3932-139-0x0000000000000000-mapping.dmp
                      • memory/4124-141-0x0000000000000000-mapping.dmp
                      • memory/4224-149-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/4224-145-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/4224-143-0x0000000000400000-0x0000000000433000-memory.dmp
                      • memory/4224-142-0x0000000000000000-mapping.dmp
                      • memory/4496-146-0x0000000000000000-mapping.dmp
                      • memory/4652-140-0x0000000000000000-mapping.dmp
                      • memory/5080-137-0x0000000000000000-mapping.dmp