Analysis
-
max time kernel
61s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-12-2020 23:34
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe
-
Size
973KB
-
MD5
670d8ac68d823b18a7c41bbd2094c2d9
-
SHA1
de92af2af28ddafc1d2946b92d8c67659d1bfa06
-
SHA256
03a2b7c25679c5df3306eac63a257589bc28d9b8b412226964ad13e932a299cc
-
SHA512
b90dc1b91a64981fb262d880c28ad8c6f149f000126884422b76cdeda24315a40a32c57dd2ceee7fd5ef7f20cedccda5ed12f01c328e5cef926c700ed210708a
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1176-16-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/1176-17-0x0000000000402BCB-mapping.dmp netwire behavioral2/memory/1176-18-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Modifies Installed Components in the registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe" SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription pid process target process PID 884 set thread context of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exepid process 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription pid process Token: SeDebugPrivilege 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exedescription pid process target process PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe PID 884 wrote to memory of 1176 884 SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.dc.19818.exe"2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-2-0x0000000073A30000-0x000000007411E000-memory.dmpFilesize
6.9MB
-
memory/884-3-0x0000000000500000-0x0000000000501000-memory.dmpFilesize
4KB
-
memory/884-5-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/884-6-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/884-7-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/884-8-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/884-9-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/884-10-0x0000000026330000-0x0000000046318000-memory.dmpFilesize
511.9MB
-
memory/884-11-0x00000000466E0000-0x0000000046764000-memory.dmpFilesize
528KB
-
memory/884-12-0x0000000005150000-0x0000000005158000-memory.dmpFilesize
32KB
-
memory/884-14-0x0000000046770000-0x00000000467D6000-memory.dmpFilesize
408KB
-
memory/884-15-0x0000000046970000-0x0000000046971000-memory.dmpFilesize
4KB
-
memory/1176-16-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1176-17-0x0000000000402BCB-mapping.dmp
-
memory/1176-18-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB