Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/12/2023, 06:56
General
-
Target
a7c3d0d7bf75bb2e25b78cebab270fb6.exe
-
Size
123KB
-
MD5
a7c3d0d7bf75bb2e25b78cebab270fb6
-
SHA1
8742ac04ab6ac6c89a2fa13b2c17d18055c33769
-
SHA256
13373ecd91432ffad9d13dc85c3614a19cbd57fc576bd968f0204ef1305b39cf
-
SHA512
f37a578053a697196a1e0d397d87bbd118b605976747222fd33a7f30ec4e63c9fb7ad48a137c3c475bf091ccb5b13144a0951bf9dc976f021e6db69ac639e86e
-
SSDEEP
3072:/4JmjzYxGn7iF4s3ft5UZmgI7Dgxess5lFE:AJmjzYx3QZm/pg
Malware Config
Extracted
netwire
vbc.publicvm.com:1002
-
activex_autorun
true
-
activex_key
{TQ754744-WA00-XI0Y-FV50-NS8J107AI1YU}
-
copy_executable
false
-
delete_original
false
-
host_id
BetaBot
-
keylogger_dir
%AppData%\Windows\
-
lock_executable
true
-
mutex
GoNTDjNn
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
Chrome
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7c3d0d7bf75bb2e25b78cebab270fb6.exe"C:\Users\Admin\AppData\Local\Temp\a7c3d0d7bf75bb2e25b78cebab270fb6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a7c3d0d7bf75bb2e25b78cebab270fb6.exe"C:\Users\Admin\AppData\Local\Temp\a7c3d0d7bf75bb2e25b78cebab270fb6.exe"2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB