Overview

overview

10

Static

static

3

أمر ا�...20.exe

windows7-x64

10

أمر ا�...20.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 15:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    أمر الشراء 90037-2020.exe

  • Size

    762KB

  • MD5

    598b0e23c0eb2baffc02fd05ce1b41e9

  • SHA1

    4129fe98ba4e3580b3b05b61a06e301ae9c4b958

  • SHA256

    a9a8374950d68997b782dca8ae2464aa81709c2f51bcc8fdb1abdcfb5b40c521

  • SHA512

    e0b9a407e34ec24dbb76b84899f2d8665a87e02f1d278007357f1cb9680a712cd91d222e57340caed8337be1c7e66cf91d9586f7403ca31412920b1b8633c619

  • SSDEEP

    12288:1CbpcLhilrm7G8oclWEAroCo3DQmTccdAAo3ZNytUAV:auLhi80Jro7JATZ0

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

43.226.229.43:2030

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    ALPHA

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    true

  • startup_name

    NetWire

  • use_mutex

    false

Signatures

  • NetWire RAT payload 6 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
    "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
      "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          PID:2632
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe" 2 2632 259393798
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2588
    • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
      "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe" 2 2192 259393486
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
        "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
          "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe"
          4⤵
          • Adds Run key to start application
          PID:2600
        • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
          "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe" 2 2600 259393798
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2720

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\Install\Host.exe
    Filesize

    762KB

    MD5

    598b0e23c0eb2baffc02fd05ce1b41e9

    SHA1

    4129fe98ba4e3580b3b05b61a06e301ae9c4b958

    SHA256

    a9a8374950d68997b782dca8ae2464aa81709c2f51bcc8fdb1abdcfb5b40c521

    SHA512

    e0b9a407e34ec24dbb76b84899f2d8665a87e02f1d278007357f1cb9680a712cd91d222e57340caed8337be1c7e66cf91d9586f7403ca31412920b1b8633c619

    Download Submit
  • memory/2024-31-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/2192-6-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/2192-3-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/2192-8-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/2360-4-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/2360-0-0x0000000000220000-0x0000000000221000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2360-1-0x00000000003E0000-0x00000000003EA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2360-2-0x00000000004D0000-0x00000000004D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2548-27-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/2588-36-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/2600-28-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/2600-33-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/2632-34-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/2720-35-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/2936-9-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/2936-10-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download