Overview

overview

10

Static

static

SecuriteIn...05.exe

windows7-x64

10

SecuriteIn...05.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21-10-2022 07:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe

  • Size

    756KB

  • MD5

    91e64955817f4a2c4a1d39926ad0ebc3

  • SHA1

    705970ffaa5d04be9ad37c001430f58fddf79d28

  • SHA256

    adcb4cadc4a186f55ab40167534aba3f36f43d716f3a2742942bcf73c2db6668

  • SHA512

    e6649200a350cca0d6c7bfeab4ba2e65f763a76118e2f51c6de982340c8260d3e185773b24537b47d103ff56b7d1242f16e03b793c6078528f572136e0f5be90

  • SSDEEP

    12288:EmxK67awP//KF5ccBBWGc2YQ5QFIgwgBzj+H9qqFf3L0bJprfIq0cT4rpFnL+hQ:Ex6Ga//KF5+2l5Qig/N+H9qAuDI3ckzF

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

podzeye2.duckdns.org:4433

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 7 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fRnurKmGZs.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fRnurKmGZs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp845D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1736
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.224685.104.8005.exe"
      2⤵
        PID:1712

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp845D.tmp
      Filesize

      1KB

      MD5

      2dd8ef9444ab298be0d2bb42739f55eb

      SHA1

      f0542c9575197ae1e244455268b28f55756b57f3

      SHA256

      93799b83c59a7972098b2f15471c12d51c44c13a69bfe2203f86114ebabbb629

      SHA512

      33f768545e13bd619c17a9b68ae0f0f39ca7c3efdd84f10f234d625f93e8922aeb81b3ffc499098fa914c915428209d70f86f29e9c8a1834239f1c1832fb326f

      Download Submit
    • memory/1200-55-0x0000000075091000-0x0000000075093000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1200-56-0x0000000004E00000-0x0000000004EE2000-memory.dmp
      Filesize

      904KB

      Download
    • memory/1200-57-0x00000000004F0000-0x0000000000508000-memory.dmp
      Filesize

      96KB

      Download
    • memory/1200-58-0x0000000000510000-0x000000000051C000-memory.dmp
      Filesize

      48KB

      Download
    • memory/1200-59-0x0000000005CF0000-0x0000000005D94000-memory.dmp
      Filesize

      656KB

      Download
    • memory/1200-54-0x0000000000C40000-0x0000000000D02000-memory.dmp
      Filesize

      776KB

      Download
    • memory/1200-64-0x000000000A170000-0x000000000A1BA000-memory.dmp
      Filesize

      296KB

      Download
    • memory/1712-65-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1712-73-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1712-81-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1712-66-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1712-68-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1712-70-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1712-72-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1712-79-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1712-76-0x000000000041AE7B-mapping.dmp
      Download
    • memory/1712-75-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1736-61-0x0000000000000000-mapping.dmp
      Download
    • memory/2008-80-0x000000006E3A0000-0x000000006E94B000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/2008-60-0x0000000000000000-mapping.dmp
      Download
    • memory/2008-82-0x000000006E3A0000-0x000000006E94B000-memory.dmp
      Filesize

      5.7MB

      Download