Overview

overview

10

Static

static

SecuriteIn...40.exe

windows7-x64

10

SecuriteIn...40.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    48s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    17-10-2022 12:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.PackedNET.1625.25625.3240.exe

  • Size

    801KB

  • MD5

    d34da4146ea2abb75f74647e85e68e0b

  • SHA1

    cd0a21838295df0a73b6cd7e4585c26b65153fbd

  • SHA256

    4c504c1ac1adf30de4604cba7720dd35ff80c629f4afd06bbb6cb36c11c05423

  • SHA512

    d435bc8c1e7e407b9975eb46b6193fad2377c08c5ac9ebcf27c7ee930fdb9a58ba59cd61bdd7e39f46ca29138ede94989a291c605ca0bd0564a446c1ebd41e7a

  • SSDEEP

    12288:pz87IeIodVTF7reI3EtJG1kUxChQWP81k2Gs/:p475zTFGZto1bQqWP81

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3345

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password@9

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 8 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1625.25625.3240.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1625.25625.3240.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZPvonV.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1536
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZPvonV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp92DE.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1452
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1625.25625.3240.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1625.25625.3240.exe"
      2⤵
        PID:1884
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1625.25625.3240.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1625.25625.3240.exe"
        2⤵
          PID:564
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1625.25625.3240.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1625.25625.3240.exe"
          2⤵
            PID:1420

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Scheduled Task

        1
        T1053

        Defense Evasion

        Credential Access

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp92DE.tmp
          Filesize

          1KB

          MD5

          fafb7150924bcf4f5aca55e8bbf0e1da

          SHA1

          0872a375e65f890ae5e547f64a179e32e442968a

          SHA256

          542257e3457313f592b0796b2310df5d6c682e28d71ca6a654725bb6b5bf4bdb

          SHA512

          3768004c5d9a3985e2719dc02784071c922b3495c877ac46ba9384e99709e7ce0b8e1587a25d4903887622eb04e02ae6dd1f1f1353053eb4bd94ea0318a6b99f

          Download Submit
        • memory/1420-73-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-71-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-67-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-70-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-69-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-80-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-78-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-64-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-65-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-74-0x0000000000400000-0x0000000000433000-memory.dmp
          Filesize

          204KB

          Download
        • memory/1420-75-0x000000000040242D-mapping.dmp
          Download
        • memory/1452-61-0x0000000000000000-mapping.dmp
          Download
        • memory/1536-59-0x0000000000000000-mapping.dmp
          Download
        • memory/1536-79-0x000000006EB80000-0x000000006F12B000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/1536-81-0x000000006EB80000-0x000000006F12B000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/1788-58-0x0000000000550000-0x00000000005D8000-memory.dmp
          Filesize

          544KB

          Download
        • memory/1788-54-0x0000000000FD0000-0x000000000109E000-memory.dmp
          Filesize

          824KB

          Download
        • memory/1788-56-0x0000000000430000-0x000000000044A000-memory.dmp
          Filesize

          104KB

          Download
        • memory/1788-57-0x00000000005F0000-0x00000000005FC000-memory.dmp
          Filesize

          48KB

          Download
        • memory/1788-63-0x00000000044C0000-0x00000000044EE000-memory.dmp
          Filesize

          184KB

          Download
        • memory/1788-55-0x00000000761F1000-0x00000000761F3000-memory.dmp
          Filesize

          8KB

          Download