Analysis

  • max time kernel
    126s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-11-2022 14:15

General

  • Target

    0d15afbcf9f4e2e70fa6887d2b320f17.exe

  • Size

    978KB

  • MD5

    0d15afbcf9f4e2e70fa6887d2b320f17

  • SHA1

    8146da1a869bb33bb3f2b3914847fddd92bbca3b

  • SHA256

    f6226702ec3ded25ec5e0d7d1cbaae386540e990857ec7604ec93284113b4897

  • SHA512

    c04de05765838d577eead19f58adb68ab78d5ed18e039d565973b5b40795402f111cccd4bbb4b6f5af87e5034f65a4cf8c4cfdd7d414fe694f99186ebf9ed2e2

  • SSDEEP

    12288:w4AkhkQNBrZsuLRuX+Ve8sXrq0C2zwf4J7czloZDo6OR+Z3S+:XGMJZsuNM+VepXrq0CRiDopS

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3363

212.193.30.230:3362

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Cantbeme@1

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 4 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe
    "C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oHiEAD.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4740
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oHiEAD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1647.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2296
    • C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe
      "C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe"
      2⤵
        PID:1320
      • C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe
        "C:\Users\Admin\AppData\Local\Temp\0d15afbcf9f4e2e70fa6887d2b320f17.exe"
        2⤵
          PID:2120

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp1647.tmp
        Filesize

        1KB

        MD5

        4848338c41444922a3de79482edf6da0

        SHA1

        1cb1679b1c2de5b376e058cc5e0f8485fee58c0f

        SHA256

        9bd7d995a00388ba4301f52a2566765e7c02acaf8fe00edc9bb2928b33594af7

        SHA512

        529ddb17a576dc807505eb02b4ea9d0557c330a09ac92384af3feeb6a6c1f6c699b2e685dad644b1011757b94df4a9714c6bb7988099332a38fcf69eba7ddd09

      • memory/1320-141-0x0000000000000000-mapping.dmp
      • memory/2120-149-0x0000000000400000-0x0000000000433000-memory.dmp
        Filesize

        204KB

      • memory/2120-144-0x0000000000400000-0x0000000000433000-memory.dmp
        Filesize

        204KB

      • memory/2120-143-0x0000000000000000-mapping.dmp
      • memory/2120-162-0x0000000000400000-0x0000000000433000-memory.dmp
        Filesize

        204KB

      • memory/2120-146-0x0000000000400000-0x0000000000433000-memory.dmp
        Filesize

        204KB

      • memory/2296-138-0x0000000000000000-mapping.dmp
      • memory/2672-136-0x0000000009060000-0x00000000090FC000-memory.dmp
        Filesize

        624KB

      • memory/2672-135-0x0000000005820000-0x000000000582A000-memory.dmp
        Filesize

        40KB

      • memory/2672-132-0x0000000000D70000-0x0000000000E6A000-memory.dmp
        Filesize

        1000KB

      • memory/2672-134-0x0000000005890000-0x0000000005922000-memory.dmp
        Filesize

        584KB

      • memory/2672-133-0x0000000005E40000-0x00000000063E4000-memory.dmp
        Filesize

        5.6MB

      • memory/4740-147-0x0000000005C70000-0x0000000005C92000-memory.dmp
        Filesize

        136KB

      • memory/4740-155-0x0000000007D60000-0x00000000083DA000-memory.dmp
        Filesize

        6.5MB

      • memory/4740-148-0x0000000005D40000-0x0000000005DA6000-memory.dmp
        Filesize

        408KB

      • memory/4740-139-0x0000000004E40000-0x0000000004E76000-memory.dmp
        Filesize

        216KB

      • memory/4740-150-0x0000000005DB0000-0x0000000005E16000-memory.dmp
        Filesize

        408KB

      • memory/4740-151-0x0000000006410000-0x000000000642E000-memory.dmp
        Filesize

        120KB

      • memory/4740-152-0x00000000069E0000-0x0000000006A12000-memory.dmp
        Filesize

        200KB

      • memory/4740-153-0x00000000719D0000-0x0000000071A1C000-memory.dmp
        Filesize

        304KB

      • memory/4740-154-0x00000000069C0000-0x00000000069DE000-memory.dmp
        Filesize

        120KB

      • memory/4740-142-0x0000000005510000-0x0000000005B38000-memory.dmp
        Filesize

        6.2MB

      • memory/4740-156-0x0000000007720000-0x000000000773A000-memory.dmp
        Filesize

        104KB

      • memory/4740-157-0x0000000007790000-0x000000000779A000-memory.dmp
        Filesize

        40KB

      • memory/4740-158-0x00000000079A0000-0x0000000007A36000-memory.dmp
        Filesize

        600KB

      • memory/4740-159-0x0000000007950000-0x000000000795E000-memory.dmp
        Filesize

        56KB

      • memory/4740-160-0x0000000007A60000-0x0000000007A7A000-memory.dmp
        Filesize

        104KB

      • memory/4740-161-0x0000000007A40000-0x0000000007A48000-memory.dmp
        Filesize

        32KB

      • memory/4740-137-0x0000000000000000-mapping.dmp