Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2022 15:47

General

  • Target

    39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe

  • Size

    648KB

  • MD5

    d6c1a5836df0a1284057bbc9ca36c81b

  • SHA1

    0579b7547ab1cb410a85004c9630c9909de5e22b

  • SHA256

    39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7

  • SHA512

    c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d

  • SSDEEP

    12288:4LHNif1w20d2fcGpXAJmzznHpFnDb2FTmB98CMaL3KFFNwXYTTTXg0:06w2G2vBqmzQTrzNwqk0

Malware Config

Signatures

  • NetWire RAT payload 5 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe
    "C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe
      "C:\Users\Admin\AppData\Local\Temp\39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3544
      • C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1268
        • C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"
          4⤵
          • Executes dropped EXE
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          PID:3412

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

2
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe
    Filesize

    648KB

    MD5

    d6c1a5836df0a1284057bbc9ca36c81b

    SHA1

    0579b7547ab1cb410a85004c9630c9909de5e22b

    SHA256

    39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7

    SHA512

    c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d

  • C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe
    Filesize

    648KB

    MD5

    d6c1a5836df0a1284057bbc9ca36c81b

    SHA1

    0579b7547ab1cb410a85004c9630c9909de5e22b

    SHA256

    39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7

    SHA512

    c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d

  • C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe
    Filesize

    648KB

    MD5

    d6c1a5836df0a1284057bbc9ca36c81b

    SHA1

    0579b7547ab1cb410a85004c9630c9909de5e22b

    SHA256

    39cc393ce3849f9e446124eda0c4a8e85a18a691d178deda0a62a06264ed36d7

    SHA512

    c70f7c13446b1ff00e02586d5778a3e4c1bd834e0d2e8aed6917d95132bd1272beae1370c81c32ba624b3ad3db8b0e6314a41ddfb0a0b589e9cf3ea173a75f2d

  • memory/1268-152-0x0000000075340000-0x00000000758F1000-memory.dmp
    Filesize

    5.7MB

  • memory/1268-142-0x0000000000000000-mapping.dmp
  • memory/1268-156-0x0000000075340000-0x00000000758F1000-memory.dmp
    Filesize

    5.7MB

  • memory/3412-146-0x0000000000000000-mapping.dmp
  • memory/3412-157-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/3544-137-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/3544-140-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/3544-135-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/3544-144-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/3544-134-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/3544-133-0x0000000000000000-mapping.dmp
  • memory/4020-141-0x0000000075340000-0x00000000758F1000-memory.dmp
    Filesize

    5.7MB

  • memory/4020-132-0x0000000075340000-0x00000000758F1000-memory.dmp
    Filesize

    5.7MB