Analysis
-
max time kernel
92s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:56
Static task
static1
Behavioral task
behavioral1
Sample
d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc.dll
Resource
win7-20220812-en
General
-
Target
d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc.dll
-
Size
5.5MB
-
MD5
7fe40fa40f7c5f09f57107f389f6391e
-
SHA1
3e38eda6e167b9e51681d7ada88fab51bee282e7
-
SHA256
d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc
-
SHA512
8792ab1c60cb51a1c445951e731aebb77100f06cadddfcc678be18b045d40cd52b51bebb9399b0ee33fb67e41e73919f33706e6017900a1c636d57b73a5b38e1
-
SSDEEP
49152:r46RlYSOQmRN8f7zTwB902KXHsQnVedoRl69dz5FfV+mT9FhZrQ8YZaq:r4kz03024efFkEhi8a9
Malware Config
Extracted
netwire
www.secureupload.online:1929
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-eqOyw8
-
lock_executable
false
-
offline_keylogger
false
-
password
Manlike1234567!
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/664-60-0x00000000043B0000-0x00000000043EF000-memory.dmp netwire behavioral1/memory/1724-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 664 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeipconfig.exepid process 976 rundll32.exe 664 ipconfig.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ipconfig.exepid process 664 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 976 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exeipconfig.exedescription pid process target process PID 1676 wrote to memory of 976 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 976 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 976 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 976 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 976 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 976 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 976 1676 rundll32.exe rundll32.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 976 wrote to memory of 664 976 rundll32.exe ipconfig.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe PID 664 wrote to memory of 1724 664 ipconfig.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"3⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/664-61-0x0000000076D40000-0x0000000076EE9000-memory.dmpFilesize
1.7MB
-
memory/664-63-0x00000000043B7000-0x00000000043C7000-memory.dmpFilesize
64KB
-
memory/664-72-0x00000000043B7000-0x00000000043C7000-memory.dmpFilesize
64KB
-
memory/664-57-0x0000000000000000-mapping.dmp
-
memory/664-62-0x0000000000210000-0x0000000000218000-memory.dmpFilesize
32KB
-
memory/664-60-0x00000000043B0000-0x00000000043EF000-memory.dmpFilesize
252KB
-
memory/976-59-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB
-
memory/976-54-0x0000000000000000-mapping.dmp
-
memory/976-55-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/976-56-0x0000000001E70000-0x0000000002414000-memory.dmpFilesize
5.6MB
-
memory/1724-66-0x0000000076D40000-0x0000000076EE9000-memory.dmpFilesize
1.7MB
-
memory/1724-64-0x0000000000000000-mapping.dmp
-
memory/1724-67-0x0000000000090000-0x0000000000098000-memory.dmpFilesize
32KB
-
memory/1724-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB