Analysis
-
max time kernel
123s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-12-2020 23:34
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe
-
Size
973KB
-
MD5
670d8ac68d823b18a7c41bbd2094c2d9
-
SHA1
de92af2af28ddafc1d2946b92d8c67659d1bfa06
-
SHA256
03a2b7c25679c5df3306eac63a257589bc28d9b8b412226964ad13e932a299cc
-
SHA512
b90dc1b91a64981fb262d880c28ad8c6f149f000126884422b76cdeda24315a40a32c57dd2ceee7fd5ef7f20cedccda5ed12f01c328e5cef926c700ed210708a
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/240-10-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/240-11-0x0000000000402BCB-mapping.dmp netwire behavioral1/memory/240-12-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Modifies Installed Components in the registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe" SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription pid process target process PID 1432 set thread context of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exepid process 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription pid process Token: SeDebugPrivilege 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription pid process target process PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 1432 wrote to memory of 240 1432 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe"2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-10-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/240-11-0x0000000000402BCB-mapping.dmp
-
memory/240-12-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1432-2-0x0000000074520000-0x0000000074C0E000-memory.dmpFilesize
6.9MB
-
memory/1432-3-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/1432-5-0x0000000025650000-0x0000000045638000-memory.dmpFilesize
511.9MB
-
memory/1432-6-0x0000000045A20000-0x0000000045AA4000-memory.dmpFilesize
528KB
-
memory/1432-7-0x0000000001E90000-0x0000000001E98000-memory.dmpFilesize
32KB
-
memory/1432-9-0x0000000045CC0000-0x0000000045D26000-memory.dmpFilesize
408KB
-
memory/1432-13-0x0000000001E20000-0x0000000001E50000-memory.dmpFilesize
192KB