Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 02:43
General
-
Target
54cd2f165cdc6bc4fcc50fce8da1206b5c1bfedb442d2a000e965019d379a719.exe
-
Size
161KB
-
MD5
ef86e680b9b0f9d2b678c2bac63ee78a
-
SHA1
bf55e08a30504a013b033c73530914e32a2e6190
-
SHA256
54cd2f165cdc6bc4fcc50fce8da1206b5c1bfedb442d2a000e965019d379a719
-
SHA512
78f8eb2a7f1189d92deb7d65a05d365952e2e36468dc30a5d92dc091ac789b0b699d80faa7a139b3f40add916b3109fb211abac2d2fa380ed373c5bd1c702f7e
-
SSDEEP
3072:S3bwUUCZjY/UURTbaiceGUlzFr0qOnZEcsx8VLJ2YMSMqqD0Ffo:S3kUjJY/fRT+iceGUlzFruZdJ2zxqqDd
Malware Config
Extracted
netwire
crimea-kremlin.duckdns.org:3396
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
Crimea
-
lock_executable
false
-
mutex
XgVApLQA
-
offline_keylogger
false
-
password
codin2318
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 14 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\54cd2f165cdc6bc4fcc50fce8da1206b5c1bfedb442d2a000e965019d379a719.exe"C:\Users\Admin\AppData\Local\Temp\54cd2f165cdc6bc4fcc50fce8da1206b5c1bfedb442d2a000e965019d379a719.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB