Overview

overview

10

Static

static

3f153b9bfc...a6.exe

windows7-x64

10

3f153b9bfc...a6.exe

windows10-2004-x64

10

Resubmissions

03-10-2022 03:29

221003-d16mysffak 10

29-09-2022 20:32

220929-za94cachbm 1

Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2022 03:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3f153b9bfc044bb0c370cabd0496c8a6.exe

  • Size

    1.1MB

  • MD5

    3f153b9bfc044bb0c370cabd0496c8a6

  • SHA1

    f98e3e3a0f5fc735f7167367fa272b5365595548

  • SHA256

    67b10001ec5c141e48e61d73c2c4d8c2c1170eecfbe8732ea5b3069d6cd333b0

  • SHA512

    a53caea88f5719ec51abbfa119aa4cfd0df9a4d90acd33356008bcfba2c45bdf60a6bacc69512969367dcc86c388da2d017bc1a7bfaed6c7cb1dc18fcf483982

  • SSDEEP

    24576:MAOcZXgZd9/37Y0W8AHei8Jluw0ixrZYZj7w84cKSVlioyvt1qztey4ZodO:a3X7DLJYLilZYZjUcKsscey4Z7

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Signatures

  • NetWire RAT payload 9 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f153b9bfc044bb0c370cabd0496c8a6.exe
    "C:\Users\Admin\AppData\Local\Temp\3f153b9bfc044bb0c370cabd0496c8a6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Users\Admin\AppData\Roaming\1_63\iblekdu.pif
      "C:\Users\Admin\AppData\Roaming\1_63\iblekdu.pif" oktfka.tel
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:964
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Windows\System32\perfmon.exe
        "C:\Windows\System32\perfmon.exe" /res
        2⤵
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:408

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\1_63\gbtbesnvka.sox
      Filesize

      255KB

      MD5

      994e61c5fbfab669f92fe05ad6c41261

      SHA1

      baf03170eb86687bc99538a4e20da67bc865a30a

      SHA256

      751d70e4c128e63edf3cb9a1318a93c26e015afffa49c068ef9a2299aa1c3419

      SHA512

      aac40c80127e4b5d31a452918cad4f05a3c727e262f2f304e0a2c4d755c6840bd7005ce67f400c422b58c459624cd7d2c6cef251822a62aa704db77049eba144

      Download Submit
    • C:\Users\Admin\AppData\Roaming\1_63\iblekdu.pif
      Filesize

      1.3MB

      MD5

      92b9ea22338dcd34bc1d8bef60a635a4

      SHA1

      b7da7f7f1533e073463ba02f986e5c17e15d39c3

      SHA256

      21dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0

      SHA512

      ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5

      Download Submit
    • C:\Users\Admin\AppData\Roaming\1_63\oktfka.tel
      Filesize

      108.1MB

      MD5

      2614f99057f77ea896bf754df72c1a5b

      SHA1

      b39d3f49f7df041f133058a6049ac0e003990067

      SHA256

      84533a67653704948d5a13b26a07414409e9d90dbadde2832ad8dd77c635a1e1

      SHA512

      38ac71fb7b5cd3b583aff749e67fbfd11e9ea3cc765ef4c5da63af41274e09b94ff6720ffc0c6b373d158000a47bee232ec2209ad3f7284f505bb9607d3ddc9c

      Download Submit
    • C:\Users\Admin\AppData\Roaming\1_63\xrldqwbq.exe
      Filesize

      60KB

      MD5

      8832c45bc05321379de0200c7819b9b3

      SHA1

      bf5d00fcc81dd64ca3bdaec714efae9b0e7b961d

      SHA256

      ae785b502e2d1136430d3c8b0a080534170d1d5e0466091113ff1fb967a77f25

      SHA512

      5b3cdb80bf3f576cbedb55259038dc534f394ef48408dc7cecb74ab8c664b70b3c2fc79b9e9ac84f1819714345508470da2b67e56f9d818daafba4e34d597fbf

      Download Submit
    • \Users\Admin\AppData\Roaming\1_63\iblekdu.pif
      Filesize

      1.3MB

      MD5

      92b9ea22338dcd34bc1d8bef60a635a4

      SHA1

      b7da7f7f1533e073463ba02f986e5c17e15d39c3

      SHA256

      21dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0

      SHA512

      ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5

      Download Submit
    • \Users\Admin\AppData\Roaming\1_63\iblekdu.pif
      Filesize

      1.3MB

      MD5

      92b9ea22338dcd34bc1d8bef60a635a4

      SHA1

      b7da7f7f1533e073463ba02f986e5c17e15d39c3

      SHA256

      21dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0

      SHA512

      ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5

      Download Submit
    • \Users\Admin\AppData\Roaming\1_63\iblekdu.pif
      Filesize

      1.3MB

      MD5

      92b9ea22338dcd34bc1d8bef60a635a4

      SHA1

      b7da7f7f1533e073463ba02f986e5c17e15d39c3

      SHA256

      21dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0

      SHA512

      ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5

      Download Submit
    • \Users\Admin\AppData\Roaming\1_63\iblekdu.pif
      Filesize

      1.3MB

      MD5

      92b9ea22338dcd34bc1d8bef60a635a4

      SHA1

      b7da7f7f1533e073463ba02f986e5c17e15d39c3

      SHA256

      21dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0

      SHA512

      ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5

      Download Submit
    • memory/408-79-0x0000000000000000-mapping.dmp
      Download
    • memory/408-83-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download
    • memory/408-82-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download
    • memory/408-81-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download
    • memory/964-68-0x00000000002326D0-mapping.dmp
      Download
    • memory/964-71-0x0000000000230000-0x0000000000835000-memory.dmp
      Filesize

      6.0MB

      Download
    • memory/964-73-0x0000000000230000-0x0000000000835000-memory.dmp
      Filesize

      6.0MB

      Download
    • memory/964-76-0x0000000000230000-0x0000000000835000-memory.dmp
      Filesize

      6.0MB

      Download
    • memory/964-67-0x0000000000230000-0x0000000000835000-memory.dmp
      Filesize

      6.0MB

      Download
    • memory/964-65-0x0000000000230000-0x0000000000835000-memory.dmp
      Filesize

      6.0MB

      Download
    • memory/1452-54-0x0000000075041000-0x0000000075043000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1548-59-0x0000000000000000-mapping.dmp
      Download
    • memory/1840-72-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1840-74-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download
    • memory/1840-75-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download
    • memory/1840-77-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download
    • memory/1840-78-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download