Overview

overview

10

Static

static

RFQ for TL...df.exe

windows7-x64

10

RFQ for TL...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    72s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2022 00:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe

  • Size

    1.0MB

  • MD5

    5ec299aa2f897d33574bb541e4e0c5c2

  • SHA1

    454ebcd9bc4f0f975f71dd8ca73ae7488c70aa50

  • SHA256

    76a3ef3003f928ebb54af1c2d09ef78eeffb1e9a485f7e2913cf3443ec0425a4

  • SHA512

    593898a5c54a5e04eb6610a800dd9d08b558c014f8dbd325c5bc929d7cf3aa590a09ad886e4160468fd4f122a24f249fbe4a56a4351c14b0f03f5b0d39ea2f43

  • SSDEEP

    12288:alTQO2iNbJ2uOqc9kD4vib9H+g+rPz3BoLVpql8tmmblKOtyzzw2xR6Xq6:ID165qcWU2H+g+zzqLVpq6mgYOtyq

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

kimlee11.duckdns.org:8839

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 7 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uSkVABbj.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:600
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uSkVABbj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF98C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:572
    • C:\Users\Admin\AppData\Local\Temp\RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe"
      2⤵
        PID:1824

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpF98C.tmp
      Filesize

      1KB

      MD5

      4a6a5100f6cb959744722d4d757715f4

      SHA1

      c20305301e46356952e47643dab2c3a788c34376

      SHA256

      1a9d7f5b082d5f87c768ae71216fcdcb5e60f91a154ce8c5e4709f43e897a009

      SHA512

      27283821a89f06b3cc099eb9d301d29c39e3c8d963e2b635f76e70f611647b76415a8dfce8548c9af4faf32d75947590ebc7820ae9bfb037df367cd735ef9015

      Download Submit
    • memory/572-60-0x0000000000000000-mapping.dmp
      Download
    • memory/600-79-0x000000006E780000-0x000000006ED2B000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/600-59-0x0000000000000000-mapping.dmp
      Download
    • memory/600-81-0x000000006E780000-0x000000006ED2B000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/1448-55-0x00000000758B1000-0x00000000758B3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1448-56-0x00000000006C0000-0x00000000006D8000-memory.dmp
      Filesize

      96KB

      Download
    • memory/1448-57-0x0000000000670000-0x000000000067C000-memory.dmp
      Filesize

      48KB

      Download
    • memory/1448-58-0x0000000005CC0000-0x0000000005D64000-memory.dmp
      Filesize

      656KB

      Download
    • memory/1448-63-0x0000000004D40000-0x0000000004D8A000-memory.dmp
      Filesize

      296KB

      Download
    • memory/1448-54-0x00000000011C0000-0x00000000012CA000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1824-65-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/1824-69-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/1824-71-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/1824-72-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/1824-74-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/1824-75-0x000000000041AD7B-mapping.dmp
      Download
    • memory/1824-78-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/1824-67-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/1824-80-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/1824-64-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download