Resubmissions

27-07-2023 13:46

230727-q22fvaeh67 10

26-07-2023 14:11

230726-rhlrqacf73 10

08-07-2023 20:07

230708-ywad6shf86 10

Analysis

  • max time kernel
    97s
  • max time network
    109s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2023 14:11

General

  • Target

    c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe

  • Size

    272KB

  • MD5

    c3a93f50ff8e4ef3d904133fffd7aced

  • SHA1

    e97d588174035ef205041e431e305477991b7d56

  • SHA256

    c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac

  • SHA512

    fcafd024c5036eeab4f5d91a176f5ac1a264796c13f2935bad5a05ca492e7637ca6a229a8818ad27ec3647135c44d25ceaeb417474b62fcfc04ebbcaef77a781

  • SSDEEP

    6144:wcCmiQfipBKWzkeHrb08rTj6aBpSYdS1wjzco7qqD9DqIx:wcXiQfipPrb08rTj6+pGHqNhx

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:6826

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    kolabo123

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 2 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe
    "C:\Users\Admin\AppData\Local\Temp\c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
      2⤵
      • Executes dropped EXE
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe

    Filesize

    272KB

    MD5

    c3a93f50ff8e4ef3d904133fffd7aced

    SHA1

    e97d588174035ef205041e431e305477991b7d56

    SHA256

    c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac

    SHA512

    fcafd024c5036eeab4f5d91a176f5ac1a264796c13f2935bad5a05ca492e7637ca6a229a8818ad27ec3647135c44d25ceaeb417474b62fcfc04ebbcaef77a781

  • \Users\Admin\AppData\Roaming\Install\Host.exe

    Filesize

    272KB

    MD5

    c3a93f50ff8e4ef3d904133fffd7aced

    SHA1

    e97d588174035ef205041e431e305477991b7d56

    SHA256

    c3c4ef008ea6903b3aa5eae43e7fe959de4438d195979a9fa8e1ae59ce56f1ac

    SHA512

    fcafd024c5036eeab4f5d91a176f5ac1a264796c13f2935bad5a05ca492e7637ca6a229a8818ad27ec3647135c44d25ceaeb417474b62fcfc04ebbcaef77a781