Analysis
-
max time kernel
72s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 21:56
Static task
static1
Behavioral task
behavioral1
Sample
d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc.dll
Resource
win7-20220812-en
General
-
Target
d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc.dll
-
Size
5.5MB
-
MD5
7fe40fa40f7c5f09f57107f389f6391e
-
SHA1
3e38eda6e167b9e51681d7ada88fab51bee282e7
-
SHA256
d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc
-
SHA512
8792ab1c60cb51a1c445951e731aebb77100f06cadddfcc678be18b045d40cd52b51bebb9399b0ee33fb67e41e73919f33706e6017900a1c636d57b73a5b38e1
-
SSDEEP
49152:r46RlYSOQmRN8f7zTwB902KXHsQnVedoRl69dz5FfV+mT9FhZrQ8YZaq:r4kz03024efFkEhi8a9
Malware Config
Extracted
netwire
www.secureupload.online:1929
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-YaU4Wi
-
lock_executable
false
-
offline_keylogger
false
-
password
Manlike1234567!
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/556-136-0x0000000004640000-0x000000000467F000-memory.dmp netwire behavioral2/memory/4532-148-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Blocklisted process makes network request 1 IoCs
Processes:
cmd.exeflow pid process 51 4532 cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 556 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeipconfig.exepid process 4716 rundll32.exe 556 ipconfig.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ipconfig.exepid process 556 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 4716 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4008 wrote to memory of 4716 4008 rundll32.exe rundll32.exe PID 4008 wrote to memory of 4716 4008 rundll32.exe rundll32.exe PID 4008 wrote to memory of 4716 4008 rundll32.exe rundll32.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe PID 4716 wrote to memory of 556 4716 rundll32.exe ipconfig.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d12471afe134cfaecadc6df2a7de16f54a9b0515f8d127ec44d650b90ea069fc.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"3⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/556-138-0x0000000004647000-0x0000000004657000-memory.dmpFilesize
64KB
-
memory/556-147-0x0000000004647000-0x0000000004657000-memory.dmpFilesize
64KB
-
memory/556-134-0x0000000000000000-mapping.dmp
-
memory/556-139-0x00007FFC2FB50000-0x00007FFC2FD45000-memory.dmpFilesize
2.0MB
-
memory/556-136-0x0000000004640000-0x000000000467F000-memory.dmpFilesize
252KB
-
memory/556-137-0x0000000000910000-0x0000000000918000-memory.dmpFilesize
32KB
-
memory/4532-141-0x00007FFC2FB50000-0x00007FFC2FD45000-memory.dmpFilesize
2.0MB
-
memory/4532-140-0x0000000000000000-mapping.dmp
-
memory/4532-142-0x0000000000A10000-0x0000000000A18000-memory.dmpFilesize
32KB
-
memory/4532-148-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4716-135-0x0000000000CC0000-0x0000000000CCA000-memory.dmpFilesize
40KB
-
memory/4716-132-0x0000000000000000-mapping.dmp
-
memory/4716-133-0x0000000002180000-0x0000000002724000-memory.dmpFilesize
5.6MB