Analysis
- max time kernel
121s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
25/02/2025, 13:02
General
- Target 910c19bc45d9dfebed20bea969b6518403647a4dbda902ce136532c305819b37.exe
- Size 200KB
- Sample250225-p966maxlt8
- SHA256 910c19bc45d9dfebed20bea969b6518403647a4dbda902ce136532c305819b37
Malware Config
Extracted
-
netwire
-
haija.mine.nu:1338
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
aegispirate
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
OOxTmvdD
-
offline_keylogger
true
-
password
qays1122
-
registry_autorun
true
-
startup_name
chrome
-
use_mutex
true
Signatures
- NetWire RAT payload 6 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Netwire family
- Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\910c19bc45d9dfebed20bea969b6518403647a4dbda902ce136532c305819b37.exe"C:\Users\Admin\AppData\Local\Temp\910c19bc45d9dfebed20bea969b6518403647a4dbda902ce136532c305819b37.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"2⤵
-
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"2⤵
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3512-0-0x00007FFE31A73000-0x00007FFE31A75000-memory.dmp
memory/3512-1-0x0000000000830000-0x0000000000864000-memory.dmp
memory/3512-2-0x00000000017A0000-0x00000000017A8000-memory.dmp
memory/3512-3-0x0000000003200000-0x0000000003233000-memory.dmp
memory/3512-10-0x00007FFE31A70000-0x00007FFE32531000-memory.dmp
memory/3512-11-0x00007FFE31A70000-0x00007FFE32531000-memory.dmp
memory/5004-4-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5004-9-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5004-12-0x0000000000400000-0x0000000000433000-memory.dmp