Analysis

  • max time kernel
    104s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-02-2023 11:11

General

  • Target

    8545b3c5f346723524e6dd29bfe64083.exe

  • Size

    948KB

  • MD5

    8545b3c5f346723524e6dd29bfe64083

  • SHA1

    e864f9c2d68edb928217325e5c8e8cc5eb86dc3f

  • SHA256

    6bd3a312c22fe9fa71fb2ace3f5ec6e8cdfc06a22a0d31f6bcb5896c083cc3ac

  • SHA512

    42fe1fbdd7ac210f331fd7da891c75509a8271bda0b6816facc4f8d6220fa51525d94d48a97e824e5d5ee4949309592324ab24a9b58a579e79d66aaf7d4cf696

  • SSDEEP

    24576:Iky9IISJqTZPEeqJa5E7Om5Fi5EuyuqUc+3l9:Y2eoam5FS9q

Malware Config

Extracted

Family

netwire

C2

zekeriyasolek44.duckdns.org:3102

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    Valentine End

  • install_path

    %Windows%\Windows DataPoint\Windows Data Start.exe

  • lock_executable

    false

  • mutex

    Windows

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 12 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
    "C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
      "C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
      2⤵
        PID:4924
      • C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
        "C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
        2⤵
          PID:4288
        • C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe
          "C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
          2⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4672
          • C:\Users\Admin\AppData\Local\Temp\%Windows\Windows DataPoint\Windows Data Start.exe
            "C:\Users\Admin\AppData\Local\Temp\%Windows\Windows DataPoint\Windows Data Start.exe" -m "C:\Users\Admin\AppData\Local\Temp\8545b3c5f346723524e6dd29bfe64083.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:456
            • C:\Users\Admin\AppData\Local\Temp\%Windows\Windows DataPoint\Windows Data Start.exe
              "C:\Users\Admin\AppData\Local\Temp\%Windows\Windows DataPoint\Windows Data Start.exe"
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              PID:616

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\%Windows\Windows DataPoint\Windows Data Start.exe
        Filesize

        948KB

        MD5

        8545b3c5f346723524e6dd29bfe64083

        SHA1

        e864f9c2d68edb928217325e5c8e8cc5eb86dc3f

        SHA256

        6bd3a312c22fe9fa71fb2ace3f5ec6e8cdfc06a22a0d31f6bcb5896c083cc3ac

        SHA512

        42fe1fbdd7ac210f331fd7da891c75509a8271bda0b6816facc4f8d6220fa51525d94d48a97e824e5d5ee4949309592324ab24a9b58a579e79d66aaf7d4cf696

      • C:\Users\Admin\AppData\Local\Temp\%Windows\Windows DataPoint\Windows Data Start.exe
        Filesize

        948KB

        MD5

        8545b3c5f346723524e6dd29bfe64083

        SHA1

        e864f9c2d68edb928217325e5c8e8cc5eb86dc3f

        SHA256

        6bd3a312c22fe9fa71fb2ace3f5ec6e8cdfc06a22a0d31f6bcb5896c083cc3ac

        SHA512

        42fe1fbdd7ac210f331fd7da891c75509a8271bda0b6816facc4f8d6220fa51525d94d48a97e824e5d5ee4949309592324ab24a9b58a579e79d66aaf7d4cf696

      • C:\Users\Admin\AppData\Local\Temp\%Windows\Windows DataPoint\Windows Data Start.exe
        Filesize

        948KB

        MD5

        8545b3c5f346723524e6dd29bfe64083

        SHA1

        e864f9c2d68edb928217325e5c8e8cc5eb86dc3f

        SHA256

        6bd3a312c22fe9fa71fb2ace3f5ec6e8cdfc06a22a0d31f6bcb5896c083cc3ac

        SHA512

        42fe1fbdd7ac210f331fd7da891c75509a8271bda0b6816facc4f8d6220fa51525d94d48a97e824e5d5ee4949309592324ab24a9b58a579e79d66aaf7d4cf696

      • C:\Users\Admin\AppData\Local\Temp\%Windows\Windows DataPoint\Windows Data Start.exe
        Filesize

        948KB

        MD5

        8545b3c5f346723524e6dd29bfe64083

        SHA1

        e864f9c2d68edb928217325e5c8e8cc5eb86dc3f

        SHA256

        6bd3a312c22fe9fa71fb2ace3f5ec6e8cdfc06a22a0d31f6bcb5896c083cc3ac

        SHA512

        42fe1fbdd7ac210f331fd7da891c75509a8271bda0b6816facc4f8d6220fa51525d94d48a97e824e5d5ee4949309592324ab24a9b58a579e79d66aaf7d4cf696

      • memory/456-158-0x0000000005580000-0x0000000005590000-memory.dmp
        Filesize

        64KB

      • memory/456-159-0x0000000005580000-0x0000000005590000-memory.dmp
        Filesize

        64KB

      • memory/616-170-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/616-168-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/616-167-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/616-166-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/616-165-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/616-164-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/616-163-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/4580-134-0x00000000053A0000-0x0000000005944000-memory.dmp
        Filesize

        5.6MB

      • memory/4580-137-0x0000000004E70000-0x0000000004E80000-memory.dmp
        Filesize

        64KB

      • memory/4580-135-0x0000000004E90000-0x0000000004F22000-memory.dmp
        Filesize

        584KB

      • memory/4580-136-0x0000000004E00000-0x0000000004E0A000-memory.dmp
        Filesize

        40KB

      • memory/4580-133-0x0000000000340000-0x0000000000434000-memory.dmp
        Filesize

        976KB

      • memory/4580-140-0x0000000006CE0000-0x0000000006D7C000-memory.dmp
        Filesize

        624KB

      • memory/4580-139-0x0000000004E70000-0x0000000004E80000-memory.dmp
        Filesize

        64KB

      • memory/4580-138-0x00000000051D0000-0x0000000005376000-memory.dmp
        Filesize

        1.6MB

      • memory/4672-157-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/4672-146-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/4672-144-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/4672-143-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/4672-141-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB