Analysis

  • max time kernel
    126s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    08-11-2022 16:21

General

  • Target

    767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe

  • Size

    1.1MB

  • MD5

    0c943a457f91fb4ccaced2fdc5bd88fa

  • SHA1

    1377fb46313fbb1df30480f732c63f8ee89d3415

  • SHA256

    767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0

  • SHA512

    1f2ee8067a072785cbd2553b2e3e91580b38dd299be16d528b18ff1a7487cb42ae5de759c95a02019937fdc8f459042391c6be3043615471e87b90944af09d33

  • SSDEEP

    24576:GoWRZYsIATu0rwZUrDCmAzvV1ONMUo0GTcQpvD65cVJFiFtIR:3WnYJKxrw2ruxDV+LGTFEtIR

Malware Config

Signatures

  • NetWire RAT payload 1 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe
    "C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe
      "C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe
        "C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe"
        3⤵
          PID:1320

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1320-70-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1320-80-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1320-79-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1320-75-0x0000000000401D82-mapping.dmp
    • memory/1320-72-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1320-74-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1320-68-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1848-59-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1848-66-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1848-65-0x0000000075241000-0x0000000075243000-memory.dmp
      Filesize

      8KB

    • memory/1848-62-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1848-63-0x0000000000401110-mapping.dmp
    • memory/1848-60-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1848-54-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1848-58-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1848-76-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1848-57-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/1848-55-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB