Overview

overview

10

Static

static

RFQ for TL...df.exe

windows7-x64

10

RFQ for TL...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2022 00:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe

  • Size

    1.0MB

  • MD5

    5ec299aa2f897d33574bb541e4e0c5c2

  • SHA1

    454ebcd9bc4f0f975f71dd8ca73ae7488c70aa50

  • SHA256

    76a3ef3003f928ebb54af1c2d09ef78eeffb1e9a485f7e2913cf3443ec0425a4

  • SHA512

    593898a5c54a5e04eb6610a800dd9d08b558c014f8dbd325c5bc929d7cf3aa590a09ad886e4160468fd4f122a24f249fbe4a56a4351c14b0f03f5b0d39ea2f43

  • SSDEEP

    12288:alTQO2iNbJ2uOqc9kD4vib9H+g+rPz3BoLVpql8tmmblKOtyzzw2xR6Xq6:ID165qcWU2H+g+zzqLVpq6mgYOtyq

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

kimlee11.duckdns.org:8839

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 4 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uSkVABbj.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4924
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uSkVABbj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F97.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:5084
    • C:\Users\Admin\AppData\Local\Temp\RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ for TLC-MR-CI-006- 174.3KB] TV-500-B(2008) pdf.exe"
      2⤵
        PID:3952

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp4F97.tmp
      Filesize

      1KB

      MD5

      c8d57eeb437278a9734a4610f58db15c

      SHA1

      33606dd3e367829cf9699bcdf598c0a2f83d633d

      SHA256

      d86e32c7932da4dcf20d607c635071d8ccde80bafd697a0fb0c056204d44c2c7

      SHA512

      58e8e80b2839347a71048adbe22e7c8d3ec748d6683ffe1602a0d9316b2f36aab0cfd55af2c9c7cff38cfd7916bf9d187ed3283c8ebe708f1e9e8673e6a6fa49

      Download Submit
    • memory/1268-133-0x0000000005FC0000-0x0000000006564000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/1268-134-0x0000000005910000-0x00000000059A2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/1268-135-0x0000000005880000-0x000000000588A000-memory.dmp
      Filesize

      40KB

      Download
    • memory/1268-136-0x000000000A590000-0x000000000A62C000-memory.dmp
      Filesize

      624KB

      Download
    • memory/1268-137-0x000000000A930000-0x000000000A996000-memory.dmp
      Filesize

      408KB

      Download
    • memory/1268-132-0x0000000000F20000-0x000000000102A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/3952-145-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/3952-149-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/3952-146-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/3952-142-0x0000000000000000-mapping.dmp
      Download
    • memory/3952-143-0x0000000000400000-0x000000000044F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/4924-153-0x00000000068D0000-0x00000000068EE000-memory.dmp
      Filesize

      120KB

      Download
    • memory/4924-157-0x00000000078C0000-0x0000000007956000-memory.dmp
      Filesize

      600KB

      Download
    • memory/4924-141-0x0000000004D70000-0x0000000004DA6000-memory.dmp
      Filesize

      216KB

      Download
    • memory/4924-147-0x0000000005370000-0x0000000005392000-memory.dmp
      Filesize

      136KB

      Download
    • memory/4924-148-0x0000000005B70000-0x0000000005BD6000-memory.dmp
      Filesize

      408KB

      Download
    • memory/4924-160-0x0000000007960000-0x0000000007968000-memory.dmp
      Filesize

      32KB

      Download
    • memory/4924-150-0x0000000006330000-0x000000000634E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/4924-151-0x0000000007330000-0x0000000007362000-memory.dmp
      Filesize

      200KB

      Download
    • memory/4924-152-0x0000000071140000-0x000000007118C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/4924-138-0x0000000000000000-mapping.dmp
      Download
    • memory/4924-154-0x0000000007CA0000-0x000000000831A000-memory.dmp
      Filesize

      6.5MB

      Download
    • memory/4924-155-0x0000000007640000-0x000000000765A000-memory.dmp
      Filesize

      104KB

      Download
    • memory/4924-156-0x00000000076A0000-0x00000000076AA000-memory.dmp
      Filesize

      40KB

      Download
    • memory/4924-144-0x00000000054D0000-0x0000000005AF8000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/4924-158-0x0000000007870000-0x000000000787E000-memory.dmp
      Filesize

      56KB

      Download
    • memory/4924-159-0x0000000007980000-0x000000000799A000-memory.dmp
      Filesize

      104KB

      Download
    • memory/5084-139-0x0000000000000000-mapping.dmp
      Download