Resubmissions
27-07-2023 13:46
230727-q22fvaeh67 1026-07-2023 14:11
230726-rhlrqacf73 1008-07-2023 20:07
230708-ywad6shf86 10Analysis
-
max time kernel
78s -
max time network
84s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
08-07-2023 20:07
Behavioral task
behavioral1
Sample
c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe
Resource
win7-20230703-en
General
-
Target
c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe
-
Size
272KB
-
MD5
c3a93f50ff8e4ef3d904133fffd7aced
-
SHA1
e97d588174035ef205041e431e305477991b7d56
-
SHA256
c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac
-
SHA512
fcafd024c5036eeab4f5d91a176f5ac1a264796c13f2935bad5a05ca492e7637ca6a229a8818ad27ec3647135c44d25ceaeb417474b62fcfc04ebbcaef77a781
-
SSDEEP
6144:wcCmiQfipBKWzkeHrb08rTj6aBpSYdS1wjzco7qqD9DqIx:wcXiQfipPrb08rTj6+pGHqNhx
Malware Config
Extracted
netwire
212.193.30.230:6826
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
kolabo123
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x000a0000000139f1-56.dat netwire behavioral1/files/0x000a0000000139f1-59.dat netwire -
Executes dropped EXE 1 IoCs
pid Process 1812 Host.exe -
Loads dropped DLL 1 IoCs
pid Process 3052 c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1812 3052 c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe 29 PID 3052 wrote to memory of 1812 3052 c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe 29 PID 3052 wrote to memory of 1812 3052 c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe 29 PID 3052 wrote to memory of 1812 3052 c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe"C:\Users\Admin\AppData\Local\Temp\c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"2⤵
- Executes dropped EXE
PID:1812
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD5c3a93f50ff8e4ef3d904133fffd7aced
SHA1e97d588174035ef205041e431e305477991b7d56
SHA256c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac
SHA512fcafd024c5036eeab4f5d91a176f5ac1a264796c13f2935bad5a05ca492e7637ca6a229a8818ad27ec3647135c44d25ceaeb417474b62fcfc04ebbcaef77a781
-
Filesize
272KB
MD5c3a93f50ff8e4ef3d904133fffd7aced
SHA1e97d588174035ef205041e431e305477991b7d56
SHA256c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac
SHA512fcafd024c5036eeab4f5d91a176f5ac1a264796c13f2935bad5a05ca492e7637ca6a229a8818ad27ec3647135c44d25ceaeb417474b62fcfc04ebbcaef77a781