Overview

overview

10

Static

static

SecuriteIn...78.exe

windows7-x64

10

SecuriteIn...78.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    55s
  • max time network
    104s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14-09-2022 08:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Mardom.MN.24.5711.7878.exe

  • Size

    590KB

  • MD5

    e3ceb848b672af6dd941b18dd773d514

  • SHA1

    1b8055a092d828a38ae9d74989dc43fc381c854a

  • SHA256

    71a260b79d48bfb8917050a14b955f79412846d10f1263ce3ad8ef14f8e07e04

  • SHA512

    5b669c7ef255294aad1182f96259b7584515f90b8a2f0ca3769ae85d644a3c8ec4e87459de6a6ff70af02fc8f86affe476beb0046146d8a3ea3158e27233053d

  • SSDEEP

    12288:9iGjtavmy2p2aY6DXaw2dXoTmSAHBsoV:r0aYxD9oTmdHBsG

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

iphanyi.edns.biz:3360

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    RDP_SEPT_2022

  • install_path

    %AppData%\Install\Host.exe

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    caster123

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 7 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.5711.7878.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.5711.7878.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.5711.7878.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.5711.7878.exe"
      2⤵
        PID:1756
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c mkdir "C:\Users\Admin\AppData\Local\Temp\windws"
        2⤵
          PID:1540
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\windws\windws.exe'" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2020
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\windws\windws.exe'" /f
            3⤵
            • Creates scheduled task(s)
            PID:560
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.5711.7878.exe" "C:\Users\Admin\AppData\Local\Temp\windws\windws.exe"
          2⤵
            PID:880
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {3D2CD713-0D2F-4CA3-9200-71C40195EE59} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
          1⤵
            PID:1076

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Scheduled Task

          1
          T1053

          Persistence

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Defense Evasion

          Credential Access

          Discovery

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/560-81-0x0000000000000000-mapping.dmp
            Download
          • memory/880-80-0x0000000000000000-mapping.dmp
            Download
          • memory/1540-76-0x0000000000000000-mapping.dmp
            Download
          • memory/1756-59-0x0000000000080000-0x00000000000D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/1756-61-0x0000000000080000-0x00000000000D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/1756-63-0x0000000000080000-0x00000000000D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/1756-64-0x0000000000080000-0x00000000000D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/1756-67-0x000000000041AE7B-mapping.dmp
            Download
          • memory/1756-68-0x0000000000080000-0x00000000000D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/1756-72-0x0000000000080000-0x00000000000D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/1756-57-0x0000000000080000-0x00000000000D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/1756-56-0x0000000000080000-0x00000000000D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/1756-79-0x0000000000080000-0x00000000000D0000-memory.dmp
            Filesize

            320KB

            Download
          • memory/2020-77-0x0000000000000000-mapping.dmp
            Download
          • memory/2044-54-0x0000000001010000-0x00000000010AA000-memory.dmp
            Filesize

            616KB

            Download
          • memory/2044-55-0x0000000075F81000-0x0000000075F83000-memory.dmp
            Filesize

            8KB

            Download