Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 01:15
Static task
static1
Behavioral task
behavioral1
Sample
5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
Resource
win7-20240221-en
General
-
Target
5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
-
Size
780KB
-
MD5
f4e294e4ff1d37874053074e502349ec
-
SHA1
ada0f22588448ffc218556ce12b045316d1ee418
-
SHA256
5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e
-
SHA512
c81582ce3119cc670f6092c82a525dc0fb9a4b68427646a7bc04fe0e0814845a82782c4284c5576453bc944f660778dc836d784d7f5fd780c56a101574cb0328
-
SSDEEP
3072:lD7fFC3Xi1NCvsHrryNyXtYUKucJcmGUcBCEHl5HHghiUjIyDvUmTncs4U+21s8D:lv06NIIKOm+YSHllAhxc2smYsvds8WC
Malware Config
Extracted
netwire
190.123.44.137:3369
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2580-7-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral1/memory/2580-9-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral1/memory/2580-13-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral1/memory/2580-14-0x0000000000400000-0x0000000000420000-memory.dmp netwire -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2580-7-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2580-9-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2580-13-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2580-14-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exedescription pid process target process PID 1732 set thread context of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exepid process 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exedescription pid process Token: SeDebugPrivilege 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exedescription pid process target process PID 1732 wrote to memory of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe PID 1732 wrote to memory of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe PID 1732 wrote to memory of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe PID 1732 wrote to memory of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe PID 1732 wrote to memory of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe PID 1732 wrote to memory of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe PID 1732 wrote to memory of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe PID 1732 wrote to memory of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe PID 1732 wrote to memory of 2580 1732 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe 5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe"C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe"C:\Users\Admin\AppData\Local\Temp\5d3cd35b14139a2a6e67171db87a035c3da9aba952969197e41fa78abdf7ff4e.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-0-0x0000000074371000-0x0000000074372000-memory.dmpFilesize
4KB
-
memory/1732-1-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/1732-2-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/1732-3-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/1732-4-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/1732-5-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/1732-12-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/2580-7-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2580-9-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2580-13-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2580-14-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB