Overview

overview

10

Static

static

3

أمر ا�...20.exe

windows7-x64

10

أمر ا�...20.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 15:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    أمر الشراء 90037-2020.exe

  • Size

    762KB

  • MD5

    598b0e23c0eb2baffc02fd05ce1b41e9

  • SHA1

    4129fe98ba4e3580b3b05b61a06e301ae9c4b958

  • SHA256

    a9a8374950d68997b782dca8ae2464aa81709c2f51bcc8fdb1abdcfb5b40c521

  • SHA512

    e0b9a407e34ec24dbb76b84899f2d8665a87e02f1d278007357f1cb9680a712cd91d222e57340caed8337be1c7e66cf91d9586f7403ca31412920b1b8633c619

  • SSDEEP

    12288:1CbpcLhilrm7G8oclWEAroCo3DQmTccdAAo3ZNytUAV:auLhi80Jro7JATZ0

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

43.226.229.43:2030

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    ALPHA

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    true

  • startup_name

    NetWire

  • use_mutex

    false

Signatures

  • NetWire RAT payload 8 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
    "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
      "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Users\Admin\AppData\Roaming\Install\Host.exe
        "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          PID:1576
        • C:\Users\Admin\AppData\Roaming\Install\Host.exe
          "C:\Users\Admin\AppData\Roaming\Install\Host.exe" 2 1576 240601937
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4008
    • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
      "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe" 2 4392 240601531
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
        "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
          "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe"
          4⤵
          • Adds Run key to start application
          PID:4772
        • C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe
          "C:\Users\Admin\AppData\Local\Temp\أمر الشراء 90037-2020.exe" 2 4772 240601937
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:900

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Install\Host.exe
    Filesize

    762KB

    MD5

    598b0e23c0eb2baffc02fd05ce1b41e9

    SHA1

    4129fe98ba4e3580b3b05b61a06e301ae9c4b958

    SHA256

    a9a8374950d68997b782dca8ae2464aa81709c2f51bcc8fdb1abdcfb5b40c521

    SHA512

    e0b9a407e34ec24dbb76b84899f2d8665a87e02f1d278007357f1cb9680a712cd91d222e57340caed8337be1c7e66cf91d9586f7403ca31412920b1b8633c619

    Download Submit
  • memory/900-38-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/1364-9-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/1364-10-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/1576-36-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/1576-27-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/1576-32-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/2824-1-0x00000000022C0000-0x00000000022CA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2824-6-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/2824-0-0x00000000005F0000-0x00000000005F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2824-2-0x00000000022E0000-0x00000000022E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3304-28-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/4008-39-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/4392-8-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/4392-18-0x0000000000440000-0x0000000000509000-memory.dmp
    Filesize

    804KB

    Download
  • memory/4392-5-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/4392-3-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/4772-33-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/4772-37-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/5036-26-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download
  • memory/5036-21-0x0000000000400000-0x00000000004C4000-memory.dmp
    Filesize

    784KB

    Download