Analysis

  • max time kernel
    77s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-11-2022 16:17

General

  • Target

    dcac7c0a08250b164343c102ef9d863a49c44343c6ce3e0cd1197cb7e3198937.exe

  • Size

    769KB

  • MD5

    cb05257018c4a1b95845ec2a3e595878

  • SHA1

    94348a7a26c0414b9f58225aba75b64697dd5f86

  • SHA256

    dcac7c0a08250b164343c102ef9d863a49c44343c6ce3e0cd1197cb7e3198937

  • SHA512

    e3bd091e5c3a8798013d55a28016497eec635f32d17583f18b18730d6182fa4cce8f72e1bc78a10315908851c20ba5e3ac0b81dc7f0c0f8fb28e11b7ceb0f4d2

  • SSDEEP

    12288:hCUL5e5qQvVHmVo+R0OXL4r70eYt8JyynITtsUXyvxwUxLfHazzJrN:s45INvVGVoU0OXLPxMyyIuVPB

Malware Config

Extracted

Family

netwire

C2

blazeblaze.ddns.net:3535

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    DATA

  • keylogger_dir

    C:\Users\Admin\AppData\Roaming\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • NetWire RAT payload 1 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • ModiLoader Second Stage 63 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcac7c0a08250b164343c102ef9d863a49c44343c6ce3e0cd1197cb7e3198937.exe
    "C:\Users\Admin\AppData\Local\Temp\dcac7c0a08250b164343c102ef9d863a49c44343c6ce3e0cd1197cb7e3198937.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\AhjreyxoO.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        3⤵
          PID:1432
        • C:\Windows\SysWOW64\xcopy.exe
          xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y
          3⤵
          • Enumerates system info in registry
          PID:3020
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
          3⤵
            PID:868
          • C:\Windows\SysWOW64\xcopy.exe
            xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y
            3⤵
            • Enumerates system info in registry
            PID:3688
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
            3⤵
              PID:1008
            • C:\Windows\SysWOW64\xcopy.exe
              xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y
              3⤵
              • Enumerates system info in registry
              PID:2204
            • C:\Windows \System32\easinvoker.exe
              "C:\Windows \System32\easinvoker.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:4616
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:448
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2972
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 6
              3⤵
              • Runs ping.exe
              PID:2888
          • C:\Users\Admin\AppData\Local\Temp\dcac7c0a08250b164343c102ef9d863a49c44343c6ce3e0cd1197cb7e3198937.exe
            "C:\Users\Admin\AppData\Local\Temp\dcac7c0a08250b164343c102ef9d863a49c44343c6ce3e0cd1197cb7e3198937.exe"
            2⤵
              PID:2000

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Defense Evasion

          Modify Registry

          1
          T1112

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          Remote System Discovery

          1
          T1018

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Public\Libraries\AhjreyxoO.bat
            Filesize

            411B

            MD5

            55aba243e88f6a6813c117ffe1fa5979

            SHA1

            210b9b028a4b798c837a182321dbf2e50d112816

            SHA256

            5a11c5641c476891aa30e7ecfa57c2639f6827d8640061f73e9afec0adbbd7d2

            SHA512

            68009c4c9bbea75a3bfa9f79945d30957a95691ea405d031b4ca7f1cb47504bbc768fcae59173885743ad4d6cfdd2313c3fe0acb515e34e5c809ecdc7f45e307

          • C:\Users\Public\Libraries\KDECO.bat
            Filesize

            155B

            MD5

            213c60adf1c9ef88dc3c9b2d579959d2

            SHA1

            e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021

            SHA256

            37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e

            SHA512

            fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7

          • C:\Users\Public\Libraries\easinvoker.exe
            Filesize

            128KB

            MD5

            231ce1e1d7d98b44371ffff407d68b59

            SHA1

            25510d0f6353dbf0c9f72fc880de7585e34b28ff

            SHA256

            30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

            SHA512

            520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

          • C:\Users\Public\Libraries\netutils.dll
            Filesize

            108KB

            MD5

            0511e36a6408d2197034ca03c7db9b02

            SHA1

            54cbb647c50076239eedd94aff3c8240eb0c4125

            SHA256

            35e4a45c3a3f42ef5d340e891e864bafc49e7e869c626bad456290c9cc888303

            SHA512

            613ba2bef07bd751aad3e21c18b6c02635fea2b02523908b61fc60aa48d8759bb9b138582e8e617555c49d9bead9fa4dfa6263f5f88f8249c89c82f136665e78

          • C:\Windows \System32\easinvoker.exe
            Filesize

            128KB

            MD5

            231ce1e1d7d98b44371ffff407d68b59

            SHA1

            25510d0f6353dbf0c9f72fc880de7585e34b28ff

            SHA256

            30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

            SHA512

            520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

          • C:\Windows \System32\easinvoker.exe
            Filesize

            128KB

            MD5

            231ce1e1d7d98b44371ffff407d68b59

            SHA1

            25510d0f6353dbf0c9f72fc880de7585e34b28ff

            SHA256

            30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

            SHA512

            520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

          • C:\Windows \System32\netutils.dll
            Filesize

            108KB

            MD5

            0511e36a6408d2197034ca03c7db9b02

            SHA1

            54cbb647c50076239eedd94aff3c8240eb0c4125

            SHA256

            35e4a45c3a3f42ef5d340e891e864bafc49e7e869c626bad456290c9cc888303

            SHA512

            613ba2bef07bd751aad3e21c18b6c02635fea2b02523908b61fc60aa48d8759bb9b138582e8e617555c49d9bead9fa4dfa6263f5f88f8249c89c82f136665e78

          • C:\Windows \System32\netutils.dll
            Filesize

            108KB

            MD5

            0511e36a6408d2197034ca03c7db9b02

            SHA1

            54cbb647c50076239eedd94aff3c8240eb0c4125

            SHA256

            35e4a45c3a3f42ef5d340e891e864bafc49e7e869c626bad456290c9cc888303

            SHA512

            613ba2bef07bd751aad3e21c18b6c02635fea2b02523908b61fc60aa48d8759bb9b138582e8e617555c49d9bead9fa4dfa6263f5f88f8249c89c82f136665e78

          • C:\windows \system32\KDECO.bat
            Filesize

            155B

            MD5

            213c60adf1c9ef88dc3c9b2d579959d2

            SHA1

            e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021

            SHA256

            37c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e

            SHA512

            fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7

          • memory/448-242-0x0000000000000000-mapping.dmp
          • memory/868-231-0x0000000000000000-mapping.dmp
          • memory/1008-234-0x0000000000000000-mapping.dmp
          • memory/1432-228-0x0000000000000000-mapping.dmp
          • memory/2000-258-0x0000000000000000-mapping.dmp
          • memory/2000-303-0x0000000000400000-0x0000000000433000-memory.dmp
            Filesize

            204KB

          • memory/2204-235-0x0000000000000000-mapping.dmp
          • memory/2808-226-0x0000000000000000-mapping.dmp
          • memory/2888-243-0x0000000000000000-mapping.dmp
          • memory/2972-245-0x0000000000000000-mapping.dmp
          • memory/2972-246-0x00000256761A0000-0x00000256761C2000-memory.dmp
            Filesize

            136KB

          • memory/2972-247-0x00007FFBC87A0000-0x00007FFBC9261000-memory.dmp
            Filesize

            10.8MB

          • memory/2972-248-0x00007FFBC87A0000-0x00007FFBC9261000-memory.dmp
            Filesize

            10.8MB

          • memory/3020-229-0x0000000000000000-mapping.dmp
          • memory/3688-232-0x0000000000000000-mapping.dmp
          • memory/4084-155-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-188-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-159-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-160-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-161-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-162-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-163-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-164-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-165-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-166-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-167-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-168-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-169-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-170-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-171-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-172-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-173-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-174-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-175-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-176-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-177-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-178-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-179-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-180-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-181-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-182-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-183-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-184-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-185-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-186-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-187-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-158-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-189-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-190-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-191-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-192-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-193-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-194-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-195-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-157-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-156-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-132-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-154-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-153-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-152-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-150-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-151-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-148-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-149-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-147-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-134-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-146-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-145-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-144-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-143-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-142-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-141-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-140-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-139-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-138-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-137-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-136-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4084-135-0x00000000022A0000-0x00000000022CB000-memory.dmp
            Filesize

            172KB

          • memory/4616-237-0x0000000000000000-mapping.dmp