Analysis
- max time kernel
147s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
26/04/2023, 01:36
General
- Target D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe
- Size 432KB
- Sample230426-b1jgbaec47
- SHA256 d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b
Malware Config
Extracted
-
netwire
-
forgiveme.workisboring.com:3360
-
activex_autorun
true
-
activex_key
{TN38RH36-U670-03U7-57DE-24XMTWQBHGH1}
-
copy_executable
true
-
delete_original
false
-
host_id
bendal
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
centosffjk
-
use_mutex
false
Signatures
- NetWire RAT payload 7 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Modifies Installed Components in the registry 2 TTPs 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe"C:\Users\Admin\AppData\Local\Temp\D8D4A25DD484E96413FF9530E93621AF5C53E96CF2B04.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Host.exe
Host.exe
memory/3356-153-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-156-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-174-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3356-171-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3356-141-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3356-144-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-145-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-146-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-155-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-148-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-149-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-150-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3356-151-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-152-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-169-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3356-167-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-147-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-154-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-157-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-158-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-159-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-160-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-161-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-162-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-163-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-165-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-164-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/3356-166-0x00000000006D0000-0x00000000006DE000-memory.dmp
memory/4056-133-0x0000000000740000-0x000000000077A000-memory.dmp
memory/4056-139-0x0000000000400000-0x0000000000470000-memory.dmp
memory/4056-140-0x0000000000740000-0x000000000077A000-memory.dmp
memory/4056-134-0x0000000000400000-0x0000000000470000-memory.dmp