Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-08-2022 15:48
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.1417.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.1417.exe
-
Size
578KB
-
MD5
a3add136bad0055382516c28b2d98ed6
-
SHA1
bb218fb9cbb76d9c4e0f4d44f3745f3405957a02
-
SHA256
5d7b005b25fc4042bf4306cb81f0e332ff10a61ead6744d4dae14da8f08b7db5
-
SHA512
0c204063f19b2603ec8bff61547d17b14ae01329a4a587c53a37ba37c0aa9122d3fead68138f10ad18788aae00aec580122c7ddc54a3e10b012ab7f5284587a0
-
SSDEEP
12288:hc0FHAlmHX2zbro5A97xpbMlylSx1LHoY/dlBKr9:ZAlmHAgA9QLW
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1492-66-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1492-67-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1492-68-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1492-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1492-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1492-72-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1492-75-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1492-81-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1884-97-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1884-101-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1884-102-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 320 Host.exe 1884 Host.exe -
Loads dropped DLL 2 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.1417.exepid process 1492 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe 1492 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.1417.exeHost.exedescription pid process target process PID 1832 set thread context of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 320 set thread context of 1884 320 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1604 schtasks.exe 1152 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.1417.exeHost.exepid process 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe 320 Host.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.1417.exeHost.exedescription pid process Token: SeDebugPrivilege 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe Token: SeDebugPrivilege 320 Host.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.1417.exeSecuriteInfo.com.W32.AIDetectNet.01.1417.exeHost.exedescription pid process target process PID 1832 wrote to memory of 1604 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe schtasks.exe PID 1832 wrote to memory of 1604 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe schtasks.exe PID 1832 wrote to memory of 1604 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe schtasks.exe PID 1832 wrote to memory of 1604 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe schtasks.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1832 wrote to memory of 1492 1832 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe SecuriteInfo.com.W32.AIDetectNet.01.1417.exe PID 1492 wrote to memory of 320 1492 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe Host.exe PID 1492 wrote to memory of 320 1492 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe Host.exe PID 1492 wrote to memory of 320 1492 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe Host.exe PID 1492 wrote to memory of 320 1492 SecuriteInfo.com.W32.AIDetectNet.01.1417.exe Host.exe PID 320 wrote to memory of 1152 320 Host.exe schtasks.exe PID 320 wrote to memory of 1152 320 Host.exe schtasks.exe PID 320 wrote to memory of 1152 320 Host.exe schtasks.exe PID 320 wrote to memory of 1152 320 Host.exe schtasks.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe PID 320 wrote to memory of 1884 320 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1417.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1417.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VqaJbkwvcY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA43C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1417.exe"{path}"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VqaJbkwvcY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B2D.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3B2D.tmpFilesize
1KB
MD56a0a4f75ebb790051c83ba9ba7eef870
SHA171335acfb9dc6f352f8396f1014c434aa4e55bf1
SHA256919d0c4cdd04f8c17e0fdfab816667d72a663a77bc7fa987451869a03f763ffd
SHA512438706c2f0669c3c3e8e5ec18c4008783c2db0f94f461bffc2a81757e32e1cbb0610ffce161dd55b64a0ca9cca0b99106e2d9895b27d958bec917fe4766034b7
-
C:\Users\Admin\AppData\Local\Temp\tmpA43C.tmpFilesize
1KB
MD56a0a4f75ebb790051c83ba9ba7eef870
SHA171335acfb9dc6f352f8396f1014c434aa4e55bf1
SHA256919d0c4cdd04f8c17e0fdfab816667d72a663a77bc7fa987451869a03f763ffd
SHA512438706c2f0669c3c3e8e5ec18c4008783c2db0f94f461bffc2a81757e32e1cbb0610ffce161dd55b64a0ca9cca0b99106e2d9895b27d958bec917fe4766034b7
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
578KB
MD5a3add136bad0055382516c28b2d98ed6
SHA1bb218fb9cbb76d9c4e0f4d44f3745f3405957a02
SHA2565d7b005b25fc4042bf4306cb81f0e332ff10a61ead6744d4dae14da8f08b7db5
SHA5120c204063f19b2603ec8bff61547d17b14ae01329a4a587c53a37ba37c0aa9122d3fead68138f10ad18788aae00aec580122c7ddc54a3e10b012ab7f5284587a0
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
578KB
MD5a3add136bad0055382516c28b2d98ed6
SHA1bb218fb9cbb76d9c4e0f4d44f3745f3405957a02
SHA2565d7b005b25fc4042bf4306cb81f0e332ff10a61ead6744d4dae14da8f08b7db5
SHA5120c204063f19b2603ec8bff61547d17b14ae01329a4a587c53a37ba37c0aa9122d3fead68138f10ad18788aae00aec580122c7ddc54a3e10b012ab7f5284587a0
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
578KB
MD5a3add136bad0055382516c28b2d98ed6
SHA1bb218fb9cbb76d9c4e0f4d44f3745f3405957a02
SHA2565d7b005b25fc4042bf4306cb81f0e332ff10a61ead6744d4dae14da8f08b7db5
SHA5120c204063f19b2603ec8bff61547d17b14ae01329a4a587c53a37ba37c0aa9122d3fead68138f10ad18788aae00aec580122c7ddc54a3e10b012ab7f5284587a0
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
578KB
MD5a3add136bad0055382516c28b2d98ed6
SHA1bb218fb9cbb76d9c4e0f4d44f3745f3405957a02
SHA2565d7b005b25fc4042bf4306cb81f0e332ff10a61ead6744d4dae14da8f08b7db5
SHA5120c204063f19b2603ec8bff61547d17b14ae01329a4a587c53a37ba37c0aa9122d3fead68138f10ad18788aae00aec580122c7ddc54a3e10b012ab7f5284587a0
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
578KB
MD5a3add136bad0055382516c28b2d98ed6
SHA1bb218fb9cbb76d9c4e0f4d44f3745f3405957a02
SHA2565d7b005b25fc4042bf4306cb81f0e332ff10a61ead6744d4dae14da8f08b7db5
SHA5120c204063f19b2603ec8bff61547d17b14ae01329a4a587c53a37ba37c0aa9122d3fead68138f10ad18788aae00aec580122c7ddc54a3e10b012ab7f5284587a0
-
memory/320-82-0x00000000010F0000-0x0000000001186000-memory.dmpFilesize
600KB
-
memory/320-78-0x0000000000000000-mapping.dmp
-
memory/1152-84-0x0000000000000000-mapping.dmp
-
memory/1492-61-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1492-62-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1492-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1492-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1492-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1492-72-0x000000000040242D-mapping.dmp
-
memory/1492-75-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1492-66-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1492-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1492-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1492-81-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1604-59-0x0000000000000000-mapping.dmp
-
memory/1832-54-0x0000000000E40000-0x0000000000ED6000-memory.dmpFilesize
600KB
-
memory/1832-58-0x0000000000900000-0x000000000092E000-memory.dmpFilesize
184KB
-
memory/1832-57-0x0000000000C70000-0x0000000000CEE000-memory.dmpFilesize
504KB
-
memory/1832-56-0x00000000005E0000-0x0000000000600000-memory.dmpFilesize
128KB
-
memory/1832-55-0x0000000075791000-0x0000000075793000-memory.dmpFilesize
8KB
-
memory/1884-97-0x000000000040242D-mapping.dmp
-
memory/1884-101-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1884-102-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB