Analysis

  • max time kernel
    144s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-10-2022 20:30

General

  • Target

    27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5.exe

  • Size

    734KB

  • MD5

    764f2688a266ba3cab3a77dc7de911d0

  • SHA1

    aabb78ced12f42e5e67d681ad0fcf26ae58b1e5d

  • SHA256

    27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5

  • SHA512

    27f8bb9039d7c67af8dcc19f7b1ae5a7601e217a381683a4380ca97baa94bf1009d9a14dcd50e964edac6599c616a3666f1900a98b4af2a9e4b7ca496c93bc73

  • SSDEEP

    12288:a8kBtlz25iIItGL94PiseTRp/3/6pVKw86hc/80c0eodG:17mGRrvQVK+hc/LpG

Malware Config

Signatures

  • NetWire RAT payload 8 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5.exe
    "C:\Users\Admin\AppData\Local\Temp\27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5.exe
      "C:\Users\Admin\AppData\Local\Temp\27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Users\Admin\AppData\Roaming\Users\public.exe
        "C:\Users\Admin\AppData\Roaming\Users\public.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Users\Admin\AppData\Roaming\Users\public.exe
          "C:\Users\Admin\AppData\Roaming\Users\public.exe"
          4⤵
          • Executes dropped EXE
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

2
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    340B

    MD5

    15eb48a76d8a001e8d3e7e2088a1aeb6

    SHA1

    b2bf61b7b3faa096f2aac0d88ee8af8c67a319e8

    SHA256

    90d2bd8f92810309854182ab89d391e9dfb7a322b3f9402c05be3a335f126831

    SHA512

    e614f8b7cb48225191ddaf87037ca9e6737d07d35e9d830117f5ece7ebb4f22dda09db3cc7d288c549f7497436bcbbe822b9df071f2737db2df0753bd21ca2bd

  • C:\Users\Admin\AppData\Roaming\Users\public.exe
    Filesize

    734KB

    MD5

    764f2688a266ba3cab3a77dc7de911d0

    SHA1

    aabb78ced12f42e5e67d681ad0fcf26ae58b1e5d

    SHA256

    27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5

    SHA512

    27f8bb9039d7c67af8dcc19f7b1ae5a7601e217a381683a4380ca97baa94bf1009d9a14dcd50e964edac6599c616a3666f1900a98b4af2a9e4b7ca496c93bc73

  • C:\Users\Admin\AppData\Roaming\Users\public.exe
    Filesize

    734KB

    MD5

    764f2688a266ba3cab3a77dc7de911d0

    SHA1

    aabb78ced12f42e5e67d681ad0fcf26ae58b1e5d

    SHA256

    27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5

    SHA512

    27f8bb9039d7c67af8dcc19f7b1ae5a7601e217a381683a4380ca97baa94bf1009d9a14dcd50e964edac6599c616a3666f1900a98b4af2a9e4b7ca496c93bc73

  • C:\Users\Admin\AppData\Roaming\Users\public.exe
    Filesize

    734KB

    MD5

    764f2688a266ba3cab3a77dc7de911d0

    SHA1

    aabb78ced12f42e5e67d681ad0fcf26ae58b1e5d

    SHA256

    27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5

    SHA512

    27f8bb9039d7c67af8dcc19f7b1ae5a7601e217a381683a4380ca97baa94bf1009d9a14dcd50e964edac6599c616a3666f1900a98b4af2a9e4b7ca496c93bc73

  • \Users\Admin\AppData\Roaming\Users\public.exe
    Filesize

    734KB

    MD5

    764f2688a266ba3cab3a77dc7de911d0

    SHA1

    aabb78ced12f42e5e67d681ad0fcf26ae58b1e5d

    SHA256

    27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5

    SHA512

    27f8bb9039d7c67af8dcc19f7b1ae5a7601e217a381683a4380ca97baa94bf1009d9a14dcd50e964edac6599c616a3666f1900a98b4af2a9e4b7ca496c93bc73

  • \Users\Admin\AppData\Roaming\Users\public.exe
    Filesize

    734KB

    MD5

    764f2688a266ba3cab3a77dc7de911d0

    SHA1

    aabb78ced12f42e5e67d681ad0fcf26ae58b1e5d

    SHA256

    27e8103629b7e24e47e592b8c32708e491f013b06ca2ffaf6b042479a93b4cc5

    SHA512

    27f8bb9039d7c67af8dcc19f7b1ae5a7601e217a381683a4380ca97baa94bf1009d9a14dcd50e964edac6599c616a3666f1900a98b4af2a9e4b7ca496c93bc73

  • memory/1612-55-0x00000000748B0000-0x0000000074E5B000-memory.dmp
    Filesize

    5.7MB

  • memory/1612-70-0x00000000748B0000-0x0000000074E5B000-memory.dmp
    Filesize

    5.7MB

  • memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp
    Filesize

    8KB

  • memory/1692-66-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/1692-68-0x0000000000402196-mapping.dmp
  • memory/1692-72-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/1692-76-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/1692-62-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/1692-59-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/1692-57-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/1692-56-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/1936-75-0x0000000000000000-mapping.dmp
  • memory/1936-96-0x0000000074870000-0x0000000074E1B000-memory.dmp
    Filesize

    5.7MB

  • memory/2004-93-0x0000000000402196-mapping.dmp
  • memory/2004-99-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/2004-100-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB