Analysis
-
max time kernel
105s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
21-10-2022 07:12
General
-
Target
SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe
-
Size
756KB
-
MD5
91e64955817f4a2c4a1d39926ad0ebc3
-
SHA1
705970ffaa5d04be9ad37c001430f58fddf79d28
-
SHA256
adcb4cadc4a186f55ab40167534aba3f36f43d716f3a2742942bcf73c2db6668
-
SHA512
e6649200a350cca0d6c7bfeab4ba2e65f763a76118e2f51c6de982340c8260d3e185773b24537b47d103ff56b7d1242f16e03b793c6078528f572136e0f5be90
-
SSDEEP
12288:EmxK67awP//KF5ccBBWGc2YQ5QFIgwgBzj+H9qqFf3L0bJprfIq0cT4rpFnL+hQ:Ex6Ga//KF5+2l5Qig/N+H9qAuDI3ckzF
Malware Config
Extracted
netwire
podzeye2.duckdns.org:4433
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 7 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fRnurKmGZs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fRnurKmGZs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp845D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe"2⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52dd8ef9444ab298be0d2bb42739f55eb
SHA1f0542c9575197ae1e244455268b28f55756b57f3
SHA25693799b83c59a7972098b2f15471c12d51c44c13a69bfe2203f86114ebabbb629
SHA51233f768545e13bd619c17a9b68ae0f0f39ca7c3efdd84f10f234d625f93e8922aeb81b3ffc499098fa914c915428209d70f86f29e9c8a1834239f1c1832fb326f
-
Filesize
8KB
-
Filesize
904KB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
656KB
-
Filesize
776KB
-
Filesize
296KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
-
Filesize
320KB
-
-
Filesize
5.7MB
-
-
Filesize
5.7MB