Analysis

  • max time kernel
    91s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2022 18:06

General

  • Target

    RE- Confirmation slip.exe

  • Size

    1.1MB

  • MD5

    c6ab29668433ac0e7358b07d4d662cb8

  • SHA1

    f69ae112b86cb0c3689a912d1812aa0413046f7f

  • SHA256

    50050a189f878a24b57acedf046acfe5011dae30f50a21054a75fcda2947ff5b

  • SHA512

    1fd74b28a9300b0967776b0ab9f2906cd75a993752a3efa4bee6d1ce9d4e37b1fc55a0af2ee8f35e50f3318c22b44e591b3ff20e39332879f2483511c834086c

  • SSDEEP

    12288:xoVsm8OIL7VpfHZtwVHtGToWVXkw3NYkulBynmE/mZu6n0oHLU/UhMIDDovTXbgd:xoYL7zHPJV0w91ulBymEOWEY/U6WM

Malware Config

Extracted

Family

netwire

C2

zonedx.ddns.net:3360

85.209.134.105:3360

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    true

  • offline_keylogger

    true

  • password

    Password9090

  • registry_autorun

    true

  • startup_name

    NetWire

  • use_mutex

    false

Signatures

  • NetWire RAT payload 4 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RE- Confirmation slip.exe
    "C:\Users\Admin\AppData\Local\Temp\RE- Confirmation slip.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zCcTNriul.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3092
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zCcTNriul" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5C58.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:424
    • C:\Users\Admin\AppData\Local\Temp\RE- Confirmation slip.exe
      "C:\Users\Admin\AppData\Local\Temp\RE- Confirmation slip.exe"
      2⤵
      • Adds Run key to start application
      PID:4028

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp5C58.tmp
    Filesize

    1KB

    MD5

    fc7f78ef5bc108af8afe56acf6af350e

    SHA1

    e7786e12adc80a09035f5eafd5583f0342d3af82

    SHA256

    839bdd92d32d92d349440b430a431bb075af94da12b2a0dcabcaaed5641d22b9

    SHA512

    d832f0b1e8c8d8a6ec0aadba559d9627f9d061f6220e89f7903a636053e09170d009277aaf322ad03666b74c2d08600cf2fa5254b8c2e15bddf7be3147d4af1f

  • memory/424-138-0x0000000000000000-mapping.dmp
  • memory/3092-147-0x0000000005830000-0x0000000005896000-memory.dmp
    Filesize

    408KB

  • memory/3092-154-0x0000000007FA0000-0x000000000861A000-memory.dmp
    Filesize

    6.5MB

  • memory/3092-148-0x0000000006020000-0x0000000006086000-memory.dmp
    Filesize

    408KB

  • memory/3092-137-0x0000000000000000-mapping.dmp
  • memory/3092-160-0x0000000007C80000-0x0000000007C88000-memory.dmp
    Filesize

    32KB

  • memory/3092-139-0x0000000002D30000-0x0000000002D66000-memory.dmp
    Filesize

    216KB

  • memory/3092-159-0x0000000007CA0000-0x0000000007CBA000-memory.dmp
    Filesize

    104KB

  • memory/3092-142-0x0000000005900000-0x0000000005F28000-memory.dmp
    Filesize

    6.2MB

  • memory/3092-158-0x0000000007B90000-0x0000000007B9E000-memory.dmp
    Filesize

    56KB

  • memory/3092-157-0x0000000007BE0000-0x0000000007C76000-memory.dmp
    Filesize

    600KB

  • memory/3092-155-0x0000000007960000-0x000000000797A000-memory.dmp
    Filesize

    104KB

  • memory/3092-146-0x0000000005790000-0x00000000057B2000-memory.dmp
    Filesize

    136KB

  • memory/3092-153-0x0000000006BF0000-0x0000000006C0E000-memory.dmp
    Filesize

    120KB

  • memory/3092-152-0x0000000070DB0000-0x0000000070DFC000-memory.dmp
    Filesize

    304KB

  • memory/3092-156-0x00000000079D0000-0x00000000079DA000-memory.dmp
    Filesize

    40KB

  • memory/3092-150-0x0000000006670000-0x000000000668E000-memory.dmp
    Filesize

    120KB

  • memory/3092-151-0x0000000006C10000-0x0000000006C42000-memory.dmp
    Filesize

    200KB

  • memory/4028-161-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/4028-145-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/4028-149-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/4028-143-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/4028-141-0x0000000000000000-mapping.dmp
  • memory/4788-136-0x000000000A4F0000-0x000000000A58C000-memory.dmp
    Filesize

    624KB

  • memory/4788-135-0x0000000007B20000-0x0000000007B2A000-memory.dmp
    Filesize

    40KB

  • memory/4788-133-0x0000000007F90000-0x0000000008534000-memory.dmp
    Filesize

    5.6MB

  • memory/4788-134-0x0000000007A80000-0x0000000007B12000-memory.dmp
    Filesize

    584KB

  • memory/4788-132-0x0000000000AF0000-0x0000000000C14000-memory.dmp
    Filesize

    1.1MB