Analysis
- max time kernel
141s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240910-en - resource tags
- submitted
13/09/2024, 12:44
General
- Target hd.sentinel.pro.4.x-5.x-Patch.exe
- Size 356KB
- Sample240913-pyw7aa1ejn
- SHA256 08b27ef5cca3892b6ed39bb59985c9e6295b4cdc2d89a52dd65040f0f995e3f2
Malware Config
Extracted
-
netwire
-
haija.mine.nu:1616
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
- NetWire RAT payload 2 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-Patch.exe"C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-Patch.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/hd.sentinel.pro.4.x-5.x-Patch.exe" "%appdata%\Data\chrom.exe" /Y2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Data\chrom.exe.lnk" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Data\chrom.exe.lnk" /f3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Data\chrom.exe:Zone.Identifier2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "%appdata%\Data\chrom.exe.jpg" chrom.exe2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\hd.sentinel.pro.4.x-5.x-Patch.exe"C:/Users/Admin/AppData/Local/Temp/hd.sentinel.pro.4.x-5.x-Patch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 3163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5036 -ip 50361⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
File.exe
chrom.exe
memory/3444-34-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3632-6-0x0000000004D70000-0x0000000004DB0000-memory.dmp
memory/3632-4-0x0000000004E10000-0x0000000004EAC000-memory.dmp
memory/3632-5-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/3632-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp
memory/3632-3-0x0000000004CD0000-0x0000000004D62000-memory.dmp
memory/3632-2-0x0000000005280000-0x0000000005824000-memory.dmp
memory/3632-32-0x0000000074BFE000-0x0000000074BFF000-memory.dmp
memory/3632-33-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/3632-1-0x0000000000250000-0x00000000002B0000-memory.dmp
memory/3632-36-0x0000000074BF0000-0x00000000753A0000-memory.dmp
memory/5036-28-0x0000000000760000-0x000000000078B000-memory.dmp
memory/5036-31-0x0000000000760000-0x000000000078B000-memory.dmp