Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
26/02/2024, 05:09
General
- Target a582f8176c5f4becf5f95a563e9ec11a.exe
- Size 1.1MB
- Sample240226-fte8jadf89
- SHA256 bd62e723aff056a5f6dd9b9ece4f5ea4bae0a50cc3bdd5f4228fb265c2a96170
Malware Config
Extracted
-
netwire
-
roban.giize.com:1604
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
- NetWire RAT payload 3 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a582f8176c5f4becf5f95a563e9ec11a.exe"C:\Users\Admin\AppData\Local\Temp\a582f8176c5f4becf5f95a563e9ec11a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell" copy-item 'C:\Users\Admin\AppData\Local\Temp\a582f8176c5f4becf5f95a563e9ec11a.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\koleno.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a582f8176c5f4becf5f95a563e9ec11a.exe"C:\Users\Admin\AppData\Local\Temp\a582f8176c5f4becf5f95a563e9ec11a.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_b5c3nf4j.5xf.ps1
memory/2416-37-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2416-40-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2416-47-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4388-55-0x0000000006DC0000-0x0000000006E56000-memory.dmp
memory/4388-52-0x0000000005600000-0x0000000005954000-memory.dmp
memory/4388-6-0x0000000002450000-0x0000000002460000-memory.dmp
memory/4388-7-0x0000000000E40000-0x0000000000E76000-memory.dmp
memory/4388-8-0x0000000004E80000-0x00000000054A8000-memory.dmp
memory/4388-54-0x0000000005DC0000-0x0000000005E0C000-memory.dmp
memory/4388-53-0x0000000005BF0000-0x0000000005C0E000-memory.dmp
memory/4388-5-0x0000000074890000-0x0000000075040000-memory.dmp
memory/4388-56-0x00000000060C0000-0x00000000060DA000-memory.dmp
memory/4388-15-0x0000000004B10000-0x0000000004B32000-memory.dmp
memory/4388-57-0x0000000006110000-0x0000000006132000-memory.dmp
memory/4388-41-0x0000000005590000-0x00000000055F6000-memory.dmp
memory/4388-63-0x0000000074890000-0x0000000075040000-memory.dmp
memory/4388-38-0x0000000005520000-0x0000000005586000-memory.dmp
memory/4640-10-0x0000000004E60000-0x0000000004E7C000-memory.dmp
memory/4640-17-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-31-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-35-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-33-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-21-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-23-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-36-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/4640-29-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-27-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-25-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-19-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-12-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-14-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-11-0x0000000004E60000-0x0000000004E75000-memory.dmp
memory/4640-0-0x0000000074890000-0x0000000075040000-memory.dmp
memory/4640-9-0x0000000004FE0000-0x0000000004FF0000-memory.dmp
memory/4640-4-0x0000000005360000-0x0000000005904000-memory.dmp
memory/4640-3-0x0000000074890000-0x0000000075040000-memory.dmp
memory/4640-2-0x0000000004BD0000-0x0000000004C6C000-memory.dmp
memory/4640-62-0x0000000074890000-0x0000000075040000-memory.dmp
memory/4640-1-0x0000000000030000-0x000000000014A000-memory.dmp