General

  • Target

    Second Order 050522.scr.exe

  • Size

    23KB

  • Sample

    220505-vf8p9abahk

  • MD5

    028e3a8a96adf5e51fb571ff91a602e4

  • SHA1

    272e32f9d6f9585439a2abe6b60737198cd40195

  • SHA256

    089c37a0afa3e281d1784c54442e67572690496a7795f28d93fa9cc3284e93c4

  • SHA512

    49a5befdcae505cf5a13bdd9fcd3993db9462f53f7b127a381a62f8b369304dfc1094d16694b4322ceea29ee02e2f9b4676a93818c5f1c7fc9fcc63ef8749dc2

Malware Config

Targets

    • Target

      Second Order 050522.scr.exe

    • Size

      23KB

    • MD5

      028e3a8a96adf5e51fb571ff91a602e4

    • SHA1

      272e32f9d6f9585439a2abe6b60737198cd40195

    • SHA256

      089c37a0afa3e281d1784c54442e67572690496a7795f28d93fa9cc3284e93c4

    • SHA512

      49a5befdcae505cf5a13bdd9fcd3993db9462f53f7b127a381a62f8b369304dfc1094d16694b4322ceea29ee02e2f9b4676a93818c5f1c7fc9fcc63ef8749dc2

    • Modifies WinLogon for persistence

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks