Resubmissions
11-01-2025 23:09
250111-25hcxstnh1 1014-12-2024 19:23
241214-x3vs1s1qbz 1012-12-2024 19:35
241212-yaxycaxkaj 10Analysis
-
max time kernel
55s -
max time network
24s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-12-2024 19:35
Static task
static1
Behavioral task
behavioral1
Sample
f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
Resource
win7-20240903-en
General
-
Target
f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe
-
Size
584KB
-
MD5
c9e985c561be0dd05c190dc70ae3518e
-
SHA1
ffbcb080efbbd36ebb9f81eded9e63c7f66cab9f
-
SHA256
f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b
-
SHA512
f1b10f5bc7bb52bf70a8e083a45a823379b1b4e0ca42e7378a07a06d4b3b8346c4dfbc95575534df9b18445eb5d56a6302d07cd86b6017f422d99dccbfec1ebb
-
SSDEEP
12288:AgIdCFdSZHZVaeSESmqf6G+SqnTrrEsYGre4YzHix:HYYSZ5VrS3xqTrPFr0c
Malware Config
Extracted
netwire
38.132.124.156:1199
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
12345
-
registry_autorun
true
-
startup_name
ronies
-
use_mutex
false
Signatures
-
NetWire RAT payload 6 IoCs
resource yara_rule behavioral1/memory/1748-54-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1748-56-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1748-51-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1748-49-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1748-47-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1748-45-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Netwire family
-
Executes dropped EXE 3 IoCs
pid Process 2040 service.exe 2704 service.exe 1748 service.exe -
Loads dropped DLL 7 IoCs
pid Process 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 2040 service.exe 2040 service.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\ronies = "C:\\Users\\Admin\\AppData\\Local\\Temp\\service.exe" service.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2040 set thread context of 1748 2040 service.exe 37 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2656 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3064 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2040 service.exe 2040 service.exe 2040 service.exe 2040 service.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2040 service.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3064 WINWORD.EXE 3064 WINWORD.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 548 wrote to memory of 2040 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 31 PID 548 wrote to memory of 2040 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 31 PID 548 wrote to memory of 2040 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 31 PID 548 wrote to memory of 2040 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 31 PID 548 wrote to memory of 3064 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 32 PID 548 wrote to memory of 3064 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 32 PID 548 wrote to memory of 3064 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 32 PID 548 wrote to memory of 3064 548 f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe 32 PID 2040 wrote to memory of 2656 2040 service.exe 33 PID 2040 wrote to memory of 2656 2040 service.exe 33 PID 2040 wrote to memory of 2656 2040 service.exe 33 PID 2040 wrote to memory of 2656 2040 service.exe 33 PID 3064 wrote to memory of 2860 3064 WINWORD.EXE 35 PID 3064 wrote to memory of 2860 3064 WINWORD.EXE 35 PID 3064 wrote to memory of 2860 3064 WINWORD.EXE 35 PID 3064 wrote to memory of 2860 3064 WINWORD.EXE 35 PID 2040 wrote to memory of 2704 2040 service.exe 36 PID 2040 wrote to memory of 2704 2040 service.exe 36 PID 2040 wrote to memory of 2704 2040 service.exe 36 PID 2040 wrote to memory of 2704 2040 service.exe 36 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37 PID 2040 wrote to memory of 1748 2040 service.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe"C:\Users\Admin\AppData\Local\Temp\f9bf619a41a56cae6b8e6d5b3fb3d3afdd7976745dbe9cc7f90ba4dcadc35d9b.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\service.exe"C:\Users\Admin\AppData\Local\Temp\service.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HRgFfvmwT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDEFA.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2656
-
-
C:\Users\Admin\AppData\Local\Temp\service.exe"C:\Users\Admin\AppData\Local\Temp\service.exe"3⤵
- Executes dropped EXE
PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\service.exe"C:\Users\Admin\AppData\Local\Temp\service.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1748
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\CPA accountant COVID_19 pandemic relief (20,000$).docx"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2860
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5f5338a212a363459b7354fd8091d5501
SHA1d5f79a7e7a664147f71dc58988462c51f489e16b
SHA2569a62f34e8c12aeed7a693399f5d17676c9af7b50865f160fc7eb4d709c252583
SHA512e033137c54ce92fec4d51f79d2cc79e6d6335060a1ba1f5ad0d30833749034c0c2c750e9cea9b654b1c36ea6cf67adddb08c0c165f46d75530cf7af1c1d81ab0
-
Filesize
1KB
MD5ae722b94b251a6c8958c59a2580bfa13
SHA13ae5c406f60365d64beb5d5902cc0c56d7e3c4b2
SHA256bf1fcd84838ac76d11f8d7190efa2293e8440a3938a0bfe01c631646d996ed9d
SHA512221c1e5c9b4c0ee75ea8042a159306ac58a8521ddd00cd464285d7fa70d0c91ac9d932c0094dab074eec58bd156cbc22061829db4556d509de4b8367f6c9622f
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
311KB
MD5a69b9cf282c900d55cd7452e039daf41
SHA10ea752ca500e4b9df336cb4438e7804d3b0186ad
SHA2563e2526d2955b6709532d1a16a221882619690292dce1527a3399a8d704a4c79d
SHA512caa067276632186c0ef2e9bf821ad64aff680645a4d0436dac2cefa7aa99feb76cb6a52e672c325ba51783635388f32cd64c2a69f0aa52c1f8f37ab4d29d1765