Overview

overview

10

Static

static

5

3678270672...96.exe

windows7-x64

10

3678270672...96.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    106s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20-10-2022 01:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe

  • Size

    4.4MB

  • MD5

    07ac1cd6e1c580500c266e2d83efc2f0

  • SHA1

    2980487d0e3c87cda631eedcf4c3e6aaaf717eda

  • SHA256

    3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296

  • SHA512

    2685933448c2c304ba330f057807a87d9faeb1dabe3481020930ca4e0bf089070cf7effb22770e667aded214ed37c7c09d2cf91129b9af4c3a68d09ef9cf915f

  • SSDEEP

    98304:K2cPK8Qh71GAnlUxvawmWybJQAlbM0azCWtg04c5b0:lCKhhZGHCwBx2bazjtf5b0

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

nl-amsterdam04.crypticvpn.com:8067

ru-moscow02.crypticvpn.com:8022

de-frankfurt03.crypticvpn.com:8022
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    Zboub-%Rand%

  • keylogger_dir

    C:\Users\Admin\AppData\Roaming\Roaming\Microsoft\MMC\Logs\

  • lock_executable

    false

  • mutex

    oLTJRPxq

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    true

Signatures

  • NetWire RAT payload 2 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Executes dropped EXE 2 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: MapViewOfSection 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
    "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Users\Admin\AppData\Local\Temp\KMSoffline_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\KMSoffline_x64.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1884
    • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
      "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
      2⤵
        PID:1328
      • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
        "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
        2⤵
          PID:1212
        • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
          "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
          2⤵
            PID:1760
          • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
            "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
            2⤵
              PID:1136
            • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
              "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
              2⤵
                PID:1700
              • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                2⤵
                  PID:852
                • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                  "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                  2⤵
                    PID:1644
                  • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                    "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                    2⤵
                      PID:1704
                    • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                      "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                      2⤵
                        PID:1940
                      • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                        "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                        2⤵
                          PID:2020
                        • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                          "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                          2⤵
                            PID:1288
                          • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                            "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                            2⤵
                              PID:1240
                            • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                              "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                              2⤵
                                PID:588
                              • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                                "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                                2⤵
                                  PID:1404
                                • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                                  "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                                  2⤵
                                    PID:1876
                                  • C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe
                                    "C:\Users\Admin\AppData\Local\Temp\3678270672216e0a460c4a836bd66b1f373fc336f443d8226154b5f5bd095296.exe"
                                    2⤵
                                      PID:320

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Initial Access

                                  Execution

                                  Persistence

                                  Privilege Escalation

                                  Defense Evasion

                                  Credential Access

                                  Discovery

                                  System Information Discovery

                                  1
                                  T1082

                                  Lateral Movement

                                  Collection

                                  Exfiltration

                                  Command and Control

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\KMSoffline_x64.exe
                                    Filesize

                                    3.2MB

                                    MD5

                                    b47f0f4b2c316cbd48a6e7bae8097007

                                    SHA1

                                    db0e8c3398e6ec8c7d8a62e205547536a2c68305

                                    SHA256

                                    cc845095b2adf954481fbd18b6e5c3a03794c7dba416178047641e32079a5cbb

                                    SHA512

                                    fe34463bf63cb111fcd1f66fcd998fe1517098abf0eb6a12dd28df48f8fbf497f30e8487a896fe5329a88c98bc469430e31d94c8816923f5f5b6fc5dc44635d2

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\KMSoffline_x64.exe
                                    Filesize

                                    3.2MB

                                    MD5

                                    b47f0f4b2c316cbd48a6e7bae8097007

                                    SHA1

                                    db0e8c3398e6ec8c7d8a62e205547536a2c68305

                                    SHA256

                                    cc845095b2adf954481fbd18b6e5c3a03794c7dba416178047641e32079a5cbb

                                    SHA512

                                    fe34463bf63cb111fcd1f66fcd998fe1517098abf0eb6a12dd28df48f8fbf497f30e8487a896fe5329a88c98bc469430e31d94c8816923f5f5b6fc5dc44635d2

                                    Download Submit
                                  • \Users\Admin\AppData\Local\Temp\KMSoffline_x64.exe
                                    Filesize

                                    3.2MB

                                    MD5

                                    b47f0f4b2c316cbd48a6e7bae8097007

                                    SHA1

                                    db0e8c3398e6ec8c7d8a62e205547536a2c68305

                                    SHA256

                                    cc845095b2adf954481fbd18b6e5c3a03794c7dba416178047641e32079a5cbb

                                    SHA512

                                    fe34463bf63cb111fcd1f66fcd998fe1517098abf0eb6a12dd28df48f8fbf497f30e8487a896fe5329a88c98bc469430e31d94c8816923f5f5b6fc5dc44635d2

                                    Download Submit
                                  • \Users\Admin\AppData\Local\Temp\KMSoffline_x64.exe
                                    Filesize

                                    3.2MB

                                    MD5

                                    b47f0f4b2c316cbd48a6e7bae8097007

                                    SHA1

                                    db0e8c3398e6ec8c7d8a62e205547536a2c68305

                                    SHA256

                                    cc845095b2adf954481fbd18b6e5c3a03794c7dba416178047641e32079a5cbb

                                    SHA512

                                    fe34463bf63cb111fcd1f66fcd998fe1517098abf0eb6a12dd28df48f8fbf497f30e8487a896fe5329a88c98bc469430e31d94c8816923f5f5b6fc5dc44635d2

                                    Download Submit
                                  • memory/320-63-0x0000000000402BCB-mapping.dmp
                                    Download
                                  • memory/320-68-0x0000000000400000-0x000000000042C000-memory.dmp
                                    Filesize

                                    176KB

                                    Download
                                  • memory/320-65-0x0000000000400000-0x000000000042C000-memory.dmp
                                    Filesize

                                    176KB

                                    Download
                                  • memory/1884-67-0x0000000000D50000-0x0000000000DFA000-memory.dmp
                                    Filesize

                                    680KB

                                    Download
                                  • memory/1884-61-0x00000000003F0000-0x000000000044C000-memory.dmp
                                    Filesize

                                    368KB

                                    Download
                                  • memory/1884-60-0x000000001B660000-0x000000001B9EC000-memory.dmp
                                    Filesize

                                    3.5MB

                                    Download
                                  • memory/1884-66-0x000007FEFB931000-0x000007FEFB933000-memory.dmp
                                    Filesize

                                    8KB

                                    Download
                                  • memory/1884-59-0x0000000000E40000-0x0000000001182000-memory.dmp
                                    Filesize

                                    3.3MB

                                    Download
                                  • memory/1884-69-0x000000001CC70000-0x000000001CCFA000-memory.dmp
                                    Filesize

                                    552KB

                                    Download
                                  • memory/1884-70-0x000000001BA50000-0x000000001BA6E000-memory.dmp
                                    Filesize

                                    120KB

                                    Download
                                  • memory/1884-56-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1884-72-0x000000001B306000-0x000000001B325000-memory.dmp
                                    Filesize

                                    124KB

                                    Download
                                  • memory/2004-62-0x0000000000250000-0x0000000000253000-memory.dmp
                                    Filesize

                                    12KB

                                    Download
                                  • memory/2004-54-0x0000000075811000-0x0000000075813000-memory.dmp
                                    Filesize

                                    8KB

                                    Download