Analysis
-
max time kernel
109s -
max time network
117s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
06-05-2021 17:56
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exe
Resource
win7v20210408
General
-
Target
SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exe
-
Size
1.8MB
-
MD5
7a5a9f55643adf965ea93bd197353248
-
SHA1
fd70e0ec9fca053c34dc08640477ff516d2d5725
-
SHA256
d072441e276c608471a851b369726d633a66ad702663cf2868d15edfe79c5e64
-
SHA512
ae0b36de0935c25aa22cd1273f550794b5e3341777e71d87ec6f74c061fcb66111875fc528a03263dcc6e8024b537dc158cedf849755c72d8c5cf9a9ed779c7d
Malware Config
Extracted
netwire
23.105.131.210:1955
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
false
-
host_id
tdce
-
install_path
%AppData%\tdce\tdce.exe
-
keylogger_dir
%AppData%\tdce\
-
lock_executable
true
-
mutex
uUTFuXPN
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
tdce
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/792-65-0x00000000001E0000-0x000000000020C000-memory.dmp netwire behavioral1/memory/792-66-0x00000000003B0000-0x00000000003E6000-memory.dmp netwire behavioral1/memory/1732-68-0x00000000003C0000-0x00000000003F6000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
tdce.exepid process 1732 tdce.exe -
Loads dropped DLL 1 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exepid process 792 SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
tdce.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ tdce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\tdce = "C:\\Users\\Admin\\AppData\\Roaming\\tdce\\tdce.exe" tdce.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exedescription pid process target process PID 792 wrote to memory of 1732 792 SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exe tdce.exe PID 792 wrote to memory of 1732 792 SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exe tdce.exe PID 792 wrote to memory of 1732 792 SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exe tdce.exe PID 792 wrote to memory of 1732 792 SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exe tdce.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36853296.10653.5222.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tdce\tdce.exe"C:\Users\Admin\AppData\Roaming\tdce\tdce.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\tdce\tdce.exeMD5
7a5a9f55643adf965ea93bd197353248
SHA1fd70e0ec9fca053c34dc08640477ff516d2d5725
SHA256d072441e276c608471a851b369726d633a66ad702663cf2868d15edfe79c5e64
SHA512ae0b36de0935c25aa22cd1273f550794b5e3341777e71d87ec6f74c061fcb66111875fc528a03263dcc6e8024b537dc158cedf849755c72d8c5cf9a9ed779c7d
-
\Users\Admin\AppData\Roaming\tdce\tdce.exeMD5
7a5a9f55643adf965ea93bd197353248
SHA1fd70e0ec9fca053c34dc08640477ff516d2d5725
SHA256d072441e276c608471a851b369726d633a66ad702663cf2868d15edfe79c5e64
SHA512ae0b36de0935c25aa22cd1273f550794b5e3341777e71d87ec6f74c061fcb66111875fc528a03263dcc6e8024b537dc158cedf849755c72d8c5cf9a9ed779c7d
-
memory/792-60-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/792-65-0x00000000001E0000-0x000000000020C000-memory.dmpFilesize
176KB
-
memory/792-66-0x00000000003B0000-0x00000000003E6000-memory.dmpFilesize
216KB
-
memory/1732-62-0x0000000000000000-mapping.dmp
-
memory/1732-68-0x00000000003C0000-0x00000000003F6000-memory.dmpFilesize
216KB