Analysis
-
max time kernel
118s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-12-2024 10:52
General
-
Target
RAT/NetWire.doc
-
Size
7.3MB
-
MD5
6b23cce75ff84aaa6216e90b6ce6a5f3
-
SHA1
e6cc0ef23044de9b1f96b67699c55232aea67f7d
-
SHA256
9105005851fbf7a7d757109cf697237c0766e6948c7d88089ac6cf25fe1e9b15
-
SHA512
4d0705644ade8e8a215cc3190717850d88f4d532ac875e504cb59b7e5c6dd3ffae69ea946e2208e2286e2f7168709850b7b6e3b6d0572de40cfe442d96bba125
-
SSDEEP
49152:GI3M51kvB7YHve+tPHAUpS60t4+6mEuKsXtz5LlqCO4n44m4uXkyNR4Ss3NZx:GuMPkvdYbgUpShGmZfXZZ1O7NRzG
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RAT\NetWire.doc" /o ""1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5d4a7e2883571bd5aadc8c42e7dde6288
SHA190d06ccbcfa36ed581a9a9af5f3581dc36387746
SHA256787b25dc26dc474d9a6a8afe13c20ec3db2d204b390c399029c92da3dbbbdd40
SHA512a204f3be5a0a95c3b6126473b6079965386c4a66d59bc0bbb40772141b65775d7db60b01caced38796c66d2bf7a6d23e8dd4970d7a9a5d40901ac19477d25714
-
Filesize
3KB
MD5be5d64b9752dc45a9335c04d4365b99f
SHA12a93d304883c6ea1873ec1e3dc3261001be188fd
SHA256dd16f179c73e4e0e1dedb8a52f825b22c38d785c8973b8ab855a3c4e63729684
SHA5128dc7690c40930a71e0f2715513c45ac63daa77533f5b34d55b4f343401e04766a29c360ba8c253e5305f38b036ffc95b2f123dee0e624177a4c4f01b7efcd95a
-
Filesize
1KB
MD54e595567f82a09e5c95ce47823c4b845
SHA1d7f2738a09ca1ce1439a01a8f4b828b7f869bb17
SHA2568fa735a12848d0538b69069a80d5a908958a2f73a6605d52b2b2c58fbb47e976
SHA51233d4a3c9bc5d0c8ca8096b02ad0dd79028d388d3234c43ec0e88fccf0c50bd58256f9f31f502874e4e7a0f6782215a4a8060f614ea25521489eee0ac768bebc5
-
Filesize
85KB
MD52a9694d02b6443549dcdc7a4dd4825ec
SHA16d30cef94444f86926b0c7c4d8cd3483bbe4c68c
SHA256ea545a31504a803c11e89f640b04cc035364765a96f1b78dc95bc97eda2e1d3f
SHA512211fb73497950cbea1c5fc2a9f5942036cb66098eaa99ab09d3e3205f059415d5fb7cb7fff39bd51a335b986a5c0ec88de5941ef1029d9c473316d88294e5305
-
Filesize
85KB
MD5c6b79ff8935c6e741b196d572489db1e
SHA14349a69ef8f1a26743f05f7b13038005932a1b50
SHA256f80c6d04f0f29fa65ed6a1c51d5edddba1ddbf359fb3eba43c6512cfe99d35e7
SHA51259034bba636bc06cded4c36b19c52a40342d774445cb2dd66820fb592c55e5c3784f03395d8873c99a2198e5b43352bb4ee554cf7a28ad0d2a3c7f91e1fd6df2
-
Filesize
90KB
MD58aac1de8975893ec4f682d7af30b8ceb
SHA10683c09b2ec4819d7003361d96043e25d8b92cd9
SHA25661f9b9b2d8ff35d2b4c9c86a27bb0c7d47d8605df7c50261b965454a125851d5
SHA5129cf7c6aeae328e26df24ae4675deac0101447d674d9377ab30d1585d25f4697a496458998d5b47b6fc77cc0619166a8b2c4e7441459175c260f99db5d403d0c2
-
Filesize
68KB
MD5b78292d151ba96efac0b6580961e1c35
SHA1eeb2c94ae1eebd4d6b3c720ba4731a32f0b31060
SHA256413cf2c265ac4522774f617d74274ba26000020a2217f01249541081a9f64e91
SHA5129dd82e375a4f8e765ce564a00b887319c86fdc5da73b46c0d49b494bf96c060771a61275546652c7e10e1f09db6b5b75a3208ecbf69e1c07a3760fb6bf897621
-
Filesize
55KB
MD52866d71f5ae350bb097d97dd6e06ea82
SHA13de6f7c39c77e33c107551418938e963ec32de57
SHA25682cf2dce33a57dd7db69349d952a3495a1d7f1c35f0ad4cf8a224377bbc97fb1
SHA5121c65190fb666ccdd2c61182b2cd243aa555b67071c4f6081d615826ef8f785fb5da27906db0fbe6cf75af0d387d3d3b4597fa4b097f3a6fcc7cede299e10a073
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB