Resubmissions

11-01-2023 16:05

230111-tjr18shc9s 10

11-01-2023 16:03

230111-thmp5ahc8x 10

11-01-2023 10:15

230111-maal9sbg63 10

Analysis

  • max time kernel
    84s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11-01-2023 16:05

General

  • Target

    PO 9047579 FDX PREMIUM 96 NTZ.exe

  • Size

    621KB

  • MD5

    ccc5553d844306dac7d4e112d27b6bf8

  • SHA1

    4699f3485ba9da714ea346c0aa1db2bb35947dda

  • SHA256

    5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2

  • SHA512

    bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c

  • SSDEEP

    12288:lAfWCREY+hUP5MMBn1CyvVwviXN4Nq0ymm82Ss0a15wKchkv3Am+8ubkw:6+07RBMMt1L9hwq0yb82SjywKcSvF+bf

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:6063

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    TestLink.lnk

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password123@

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 10 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 2 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe
    "C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aTGTGTYybfHCv.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1868
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aTGTGTYybfHCv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1804
    • C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe
      "C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe"
      2⤵
        PID:1320
      • C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe
        "C:\Users\Admin\AppData\Local\Temp\PO 9047579 FDX PREMIUM 96 NTZ.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:820
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aTGTGTYybfHCv.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:664
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aTGTGTYybfHCv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4645.tmp"
            4⤵
            • Creates scheduled task(s)
            PID:1720
          • C:\Users\Admin\AppData\Roaming\Install\Host.exe
            "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
            4⤵
            • Executes dropped EXE
            • Drops startup file
            • Loads dropped DLL
            • Adds Run key to start application
            PID:1812

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp4645.tmp
      Filesize

      1KB

      MD5

      468f0c8b9f88c4307568493b494afef6

      SHA1

      3e9240e69aa0e5d0041524c630890f93377d8d58

      SHA256

      3125f0828e2a9c8ad687d1ff14320b9aedf1f2eaf774ad645641f46954f58a92

      SHA512

      0e91acf39673845bf8e9ff57511fb55c9ff2f78f23d7458bf1a5415b586516e0745a484bf7a88575962317e37508b00ba1dae75a33d1387874185849eeb63fc3

    • C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp
      Filesize

      1KB

      MD5

      468f0c8b9f88c4307568493b494afef6

      SHA1

      3e9240e69aa0e5d0041524c630890f93377d8d58

      SHA256

      3125f0828e2a9c8ad687d1ff14320b9aedf1f2eaf774ad645641f46954f58a92

      SHA512

      0e91acf39673845bf8e9ff57511fb55c9ff2f78f23d7458bf1a5415b586516e0745a484bf7a88575962317e37508b00ba1dae75a33d1387874185849eeb63fc3

    • C:\Users\Admin\AppData\Roaming\Install\Host.exe
      Filesize

      621KB

      MD5

      ccc5553d844306dac7d4e112d27b6bf8

      SHA1

      4699f3485ba9da714ea346c0aa1db2bb35947dda

      SHA256

      5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2

      SHA512

      bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c

    • C:\Users\Admin\AppData\Roaming\Install\Host.exe
      Filesize

      621KB

      MD5

      ccc5553d844306dac7d4e112d27b6bf8

      SHA1

      4699f3485ba9da714ea346c0aa1db2bb35947dda

      SHA256

      5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2

      SHA512

      bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c

    • C:\Users\Admin\AppData\Roaming\Install\Host.exe
      Filesize

      621KB

      MD5

      ccc5553d844306dac7d4e112d27b6bf8

      SHA1

      4699f3485ba9da714ea346c0aa1db2bb35947dda

      SHA256

      5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2

      SHA512

      bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      ec82b538c54f2c7cbf3fab2b8178cd9f

      SHA1

      4ff663d9d8d8e6f4d83b1afa6b3aaeca0ae154dd

      SHA256

      4136356e420937ae7f7b7330caaa10860ac9a417f9ae3b17336e0522c9a377b7

      SHA512

      abc821cc7fe003ab294b1af94bd54591db5eeecdfdda946639103fcbcaa48f46d86a29070e45b0073e0b4409e80adbec393d77579bb18fbcf240bad2f6634d3c

    • \Users\Admin\AppData\Roaming\Install\Host.exe
      Filesize

      621KB

      MD5

      ccc5553d844306dac7d4e112d27b6bf8

      SHA1

      4699f3485ba9da714ea346c0aa1db2bb35947dda

      SHA256

      5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2

      SHA512

      bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c

    • \Users\Admin\AppData\Roaming\Install\Host.exe
      Filesize

      621KB

      MD5

      ccc5553d844306dac7d4e112d27b6bf8

      SHA1

      4699f3485ba9da714ea346c0aa1db2bb35947dda

      SHA256

      5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2

      SHA512

      bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c

    • \Users\Admin\AppData\Roaming\Install\Host.exe
      Filesize

      621KB

      MD5

      ccc5553d844306dac7d4e112d27b6bf8

      SHA1

      4699f3485ba9da714ea346c0aa1db2bb35947dda

      SHA256

      5a8b1edfe9a05b20ec2ec3891cbe298913e9c8e29fae4e94411bc3766c907be2

      SHA512

      bd8ded22ff3f94f9f5148938d2e880b1045549315b4127c5ed0a85183f0aac49d0091391328dfcce1509c7c982a0111e2f6339b093eb367a157409549e8be46c

    • memory/664-89-0x0000000000000000-mapping.dmp
    • memory/664-111-0x0000000073330000-0x00000000738DB000-memory.dmp
      Filesize

      5.7MB

    • memory/820-81-0x0000000000000000-mapping.dmp
    • memory/820-85-0x0000000000BC0000-0x0000000000C62000-memory.dmp
      Filesize

      648KB

    • memory/1680-83-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1680-65-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1680-75-0x000000000041AD7B-mapping.dmp
    • memory/1680-74-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1680-78-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1680-64-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1680-71-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1680-72-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1680-67-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1680-69-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1720-90-0x0000000000000000-mapping.dmp
    • memory/1804-60-0x0000000000000000-mapping.dmp
    • memory/1812-105-0x000000000041AD7B-mapping.dmp
    • memory/1812-112-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1812-109-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

    • memory/1868-59-0x0000000000000000-mapping.dmp
    • memory/1868-87-0x000000006E9B0000-0x000000006EF5B000-memory.dmp
      Filesize

      5.7MB

    • memory/1868-88-0x000000006E9B0000-0x000000006EF5B000-memory.dmp
      Filesize

      5.7MB

    • memory/2036-63-0x0000000005E70000-0x0000000005EBC000-memory.dmp
      Filesize

      304KB

    • memory/2036-56-0x0000000000240000-0x0000000000256000-memory.dmp
      Filesize

      88KB

    • memory/2036-57-0x00000000003A0000-0x00000000003AA000-memory.dmp
      Filesize

      40KB

    • memory/2036-55-0x00000000762D1000-0x00000000762D3000-memory.dmp
      Filesize

      8KB

    • memory/2036-58-0x00000000052A0000-0x0000000005326000-memory.dmp
      Filesize

      536KB

    • memory/2036-54-0x0000000000810000-0x00000000008B2000-memory.dmp
      Filesize

      648KB