Overview

overview

10

Static

static

SecuriteIn...00.exe

windows7-x64

10

SecuriteIn...00.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    103s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2022 09:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.21294.3900.exe

  • Size

    1.1MB

  • MD5

    cfb78cd713d80aa92ba275f06b735d50

  • SHA1

    7082fbbcea7765f24544aad61c5efe509ba6502e

  • SHA256

    63c76b6d8a6c83e113d4a72361c8df64d493339fe94503522b3f666b19aacfa2

  • SHA512

    f684c1d9cc71e2677285502de46b3fc1c37912c9cad6f3b647ffcafe53c26df229b171b11e902fb1178f8280813ac809143448d06ea1688805efe7f175c8bd93

  • SSDEEP

    12288:At2PHkEXbqyYsBFMWYndz5BOX58Hh8l84VFULbCzhAEGgeIlAtityZN9u7PKeJt+:5Hk1sBG7il9FUL+4ftVZiFJd2KoJZ5

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

podzeye2.duckdns.org:4433

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 8 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21294.3900.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.21294.3900.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oiISCbfmn.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1736
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oiISCbfmn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3FA0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1008
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:580

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scripting

    1
    T1064

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Scripting

    1
    T1064

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp3FA0.tmp
      Filesize

      1KB

      MD5

      f99019a24393ac47e2930305ebab5764

      SHA1

      16303b2f8055bba02456648895793102c89493a5

      SHA256

      fbaa889956cd747ffed30c46980a4b6e01fb1c789715fa93e365c491350f0907

      SHA512

      6974651edb5b938aa727d5b26ad5e93e22097161fd7161925db958d8cafae60cb53b51c534085123717d7700e6a9f442487a86adf170e9cbcc384b5cd848bd8e

      Download Submit
    • memory/580-73-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/580-72-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/580-68-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/580-66-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/580-80-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/580-79-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/580-76-0x000000000041AE7B-mapping.dmp
      Download
    • memory/580-75-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/580-70-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/580-65-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/580-83-0x0000000000400000-0x0000000000450000-memory.dmp
      Filesize

      320KB

      Download
    • memory/1008-61-0x0000000000000000-mapping.dmp
      Download
    • memory/1736-60-0x0000000000000000-mapping.dmp
      Download
    • memory/1736-81-0x000000006DE30000-0x000000006E3DB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/1736-82-0x000000006DE30000-0x000000006E3DB000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/1908-64-0x00000000052D0000-0x0000000005328000-memory.dmp
      Filesize

      352KB

      Download
    • memory/1908-57-0x00000000006D0000-0x00000000006E8000-memory.dmp
      Filesize

      96KB

      Download
    • memory/1908-54-0x0000000000150000-0x0000000000276000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/1908-55-0x00000000753C1000-0x00000000753C3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1908-56-0x0000000002060000-0x000000000210E000-memory.dmp
      Filesize

      696KB

      Download
    • memory/1908-59-0x00000000057F0000-0x0000000005882000-memory.dmp
      Filesize

      584KB

      Download
    • memory/1908-58-0x0000000000390000-0x000000000039C000-memory.dmp
      Filesize

      48KB

      Download