Overview

overview

10

Static

static

SecuriteIn...93.exe

windows7-x64

3

SecuriteIn...93.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-09-2022 10:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.6893.exe

  • Size

    1.1MB

  • MD5

    27894c3876db96d4beb862daaae52e07

  • SHA1

    6baa94cb18f135f03b7ae3fcbb80c600d44fdfd0

  • SHA256

    b57ed5956f300093ccca133cf806845cfaf4e11c067188cde5dd484be77a26c3

  • SHA512

    7caadfcbddabb5629dc765d4c94ab91866d01a10b8081c51de8a12e053a6eea9c71bd7b86ea74de5804c88993d64cf2537efc46e6650cf9c4a98502218fb616f

  • SSDEEP

    24576:3L4LJNZ2RWEmmd9JKgmus+BUSB15OwP4:ELJNemmi+rK

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3345

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password@9

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 4 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6893.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6893.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bmzmLDNY.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1664
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bmzmLDNY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp93E3.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3656
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6893.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6893.exe"
      2⤵
        PID:4896
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6893.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.6893.exe"
        2⤵
          PID:3816

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp93E3.tmp
        Filesize

        1KB

        MD5

        943c36d0c09d07c9ceffb3de3e2f697c

        SHA1

        8e8a2bcbab3863024eb2eac9a62c7f1452698e47

        SHA256

        f003595304cfe5c516a26d61cf4f9f30050055b185e3da562066ac32a092f2f2

        SHA512

        fb103c1e5399c8d89202a758faafe4687eed4ee281372a862b6bcd0dc5f021cb0576708d73eb773f4501ee08dfe21f614c8e883985fff843edc4128bb388c27e

        Download Submit
      • memory/1664-157-0x0000000007A20000-0x0000000007A2A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/1664-140-0x0000000002D80000-0x0000000002DB6000-memory.dmp
        Filesize

        216KB

        Download
      • memory/1664-160-0x0000000007CF0000-0x0000000007D0A000-memory.dmp
        Filesize

        104KB

        Download
      • memory/1664-161-0x0000000007CD0000-0x0000000007CD8000-memory.dmp
        Filesize

        32KB

        Download
      • memory/1664-154-0x0000000006C60000-0x0000000006C7E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/1664-138-0x0000000000000000-mapping.dmp
        Download
      • memory/1664-153-0x0000000070DB0000-0x0000000070DFC000-memory.dmp
        Filesize

        304KB

        Download
      • memory/1664-150-0x0000000005FC0000-0x0000000006026000-memory.dmp
        Filesize

        408KB

        Download
      • memory/1664-159-0x0000000007BE0000-0x0000000007BEE000-memory.dmp
        Filesize

        56KB

        Download
      • memory/1664-142-0x00000000058C0000-0x0000000005EE8000-memory.dmp
        Filesize

        6.2MB

        Download
      • memory/1664-155-0x0000000008000000-0x000000000867A000-memory.dmp
        Filesize

        6.5MB

        Download
      • memory/1664-152-0x0000000006C80000-0x0000000006CB2000-memory.dmp
        Filesize

        200KB

        Download
      • memory/1664-151-0x00000000066B0000-0x00000000066CE000-memory.dmp
        Filesize

        120KB

        Download
      • memory/1664-158-0x0000000007C30000-0x0000000007CC6000-memory.dmp
        Filesize

        600KB

        Download
      • memory/1664-156-0x00000000079B0000-0x00000000079CA000-memory.dmp
        Filesize

        104KB

        Download
      • memory/1664-149-0x0000000005F20000-0x0000000005F42000-memory.dmp
        Filesize

        136KB

        Download
      • memory/2316-132-0x0000000000A20000-0x0000000000B36000-memory.dmp
        Filesize

        1.1MB

        Download
      • memory/2316-133-0x0000000005B80000-0x0000000006124000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/2316-135-0x0000000005570000-0x000000000557A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/2316-134-0x00000000054D0000-0x0000000005562000-memory.dmp
        Filesize

        584KB

        Download
      • memory/2316-137-0x0000000007830000-0x0000000007896000-memory.dmp
        Filesize

        408KB

        Download
      • memory/2316-136-0x0000000009A40000-0x0000000009ADC000-memory.dmp
        Filesize

        624KB

        Download
      • memory/3656-139-0x0000000000000000-mapping.dmp
        Download
      • memory/3816-148-0x0000000000400000-0x0000000000433000-memory.dmp
        Filesize

        204KB

        Download
      • memory/3816-147-0x0000000000400000-0x0000000000433000-memory.dmp
        Filesize

        204KB

        Download
      • memory/3816-145-0x0000000000400000-0x0000000000433000-memory.dmp
        Filesize

        204KB

        Download
      • memory/3816-144-0x0000000000000000-mapping.dmp
        Download
      • memory/3816-162-0x0000000000400000-0x0000000000433000-memory.dmp
        Filesize

        204KB

        Download
      • memory/4896-143-0x0000000000000000-mapping.dmp
        Download