Analysis

  • max time kernel
    137s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03-11-2022 14:15

General

  • Target

    0d15afbcf9f4e2e70fa6887d2b320f17.exe

  • Size

    978KB

  • MD5

    0d15afbcf9f4e2e70fa6887d2b320f17

  • SHA1

    8146da1a869bb33bb3f2b3914847fddd92bbca3b

  • SHA256

    f6226702ec3ded25ec5e0d7d1cbaae386540e990857ec7604ec93284113b4897

  • SHA512

    c04de05765838d577eead19f58adb68ab78d5ed18e039d565973b5b40795402f111cccd4bbb4b6f5af87e5034f65a4cf8c4cfdd7d414fe694f99186ebf9ed2e2

  • SSDEEP

    12288:w4AkhkQNBrZsuLRuX+Ve8sXrq0C2zwf4J7czloZDo6OR+Z3S+:XGMJZsuNM+VepXrq0CRiDopS

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

212.193.30.230:3362

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Cantbeme@1

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 9 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe
    "C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oHiEAD.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1776
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oHiEAD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp49ED.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1636
    • C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe
      "C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe"
      2⤵
        PID:1268

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp49ED.tmp
      Filesize

      1KB

      MD5

      c8f41631acf7533a06e2ebfb3e3c9bdb

      SHA1

      b96dbe972efefe823e38f4d50f8b41ad569dbe93

      SHA256

      7a6fd1e830960c2dbb8f7a19620a8024a4c8d07327814cf0ee730167689e6712

      SHA512

      f56a726c820aee3dc372fc2cc7e4ab122d94b86714c54d965efcc79ae3fe4cf0ca0445309797642f63b86c16b49afd412a056886332052263a0ef0bac4c42497

    • memory/1268-73-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-71-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-69-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-67-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-75-0x000000000040242D-mapping.dmp
    • memory/1268-74-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-78-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-70-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-65-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-82-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-79-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1268-64-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

    • memory/1636-60-0x0000000000000000-mapping.dmp
    • memory/1776-59-0x0000000000000000-mapping.dmp
    • memory/1776-80-0x000000006F200000-0x000000006F7AB000-memory.dmp
      Filesize

      5.7MB

    • memory/1776-81-0x000000006F200000-0x000000006F7AB000-memory.dmp
      Filesize

      5.7MB

    • memory/2020-55-0x0000000075451000-0x0000000075453000-memory.dmp
      Filesize

      8KB

    • memory/2020-54-0x0000000001160000-0x000000000125A000-memory.dmp
      Filesize

      1000KB

    • memory/2020-57-0x00000000004C0000-0x00000000004CC000-memory.dmp
      Filesize

      48KB

    • memory/2020-63-0x0000000001000000-0x000000000102E000-memory.dmp
      Filesize

      184KB

    • memory/2020-56-0x00000000004A0000-0x00000000004B6000-memory.dmp
      Filesize

      88KB

    • memory/2020-58-0x0000000005D80000-0x0000000005DEA000-memory.dmp
      Filesize

      424KB