Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2022 16:21

General

  • Target

    767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe

  • Size

    1.1MB

  • MD5

    0c943a457f91fb4ccaced2fdc5bd88fa

  • SHA1

    1377fb46313fbb1df30480f732c63f8ee89d3415

  • SHA256

    767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0

  • SHA512

    1f2ee8067a072785cbd2553b2e3e91580b38dd299be16d528b18ff1a7487cb42ae5de759c95a02019937fdc8f459042391c6be3043615471e87b90944af09d33

  • SSDEEP

    24576:GoWRZYsIATu0rwZUrDCmAzvV1ONMUo0GTcQpvD65cVJFiFtIR:3WnYJKxrw2ruxDV+LGTFEtIR

Malware Config

Signatures

  • NetWire RAT payload 1 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe
    "C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe
      "C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:368
      • C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe
        "C:\Users\Admin\AppData\Local\Temp\767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0.exe"
        3⤵
          PID:5080

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/368-132-0x0000000000000000-mapping.dmp
    • memory/368-133-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/368-135-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/368-139-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/5080-136-0x0000000000000000-mapping.dmp
    • memory/5080-137-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/5080-140-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB

    • memory/5080-141-0x0000000000400000-0x0000000000417000-memory.dmp
      Filesize

      92KB