Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2023 08:37
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe
Resource
win7-20221111-en
General
-
Target
SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe
-
Size
715KB
-
MD5
14a8ed4f4d833c20f775d254eb751f2d
-
SHA1
5c3282c4b919fb7d5a84a8026233fe358de5a022
-
SHA256
b3cd1a80df7ae1654da07a03006781c83240814dd6d99db27f1733ed8267661c
-
SHA512
5210cffe7b9b7fb2fa884a71ee599c9305df08270ffc766afa8a409fff9eab5597bd1c677312e8afb0c27caf0966e416e653b5d20b738aadece91e292de14f18
-
SSDEEP
12288:9zJs9gjEzcfWT+9FOcfx1HsAYaZAtpuxHJNp7lbheaiA/yQRq9CLQrx99s2z:U35Mx3Ya8ApbPeoyN9CWTs2
Malware Config
Extracted
netwire
212.193.30.230:7324
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password123
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1616-143-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/1616-144-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/1616-145-0x0000000000400000-0x000000000044F000-memory.dmp netwire behavioral2/memory/1616-151-0x0000000000400000-0x000000000044F000-memory.dmp netwire -
Executes dropped EXE 1 IoCs
Processes:
Host.exepid process 2696 Host.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Win32.RATX-gen.8711.15068.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.8711.15068.exedescription pid process target process PID 1644 set thread context of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.8711.15068.exepowershell.exepid process 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe 488 powershell.exe 488 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.8711.15068.exepowershell.exedescription pid process Token: SeDebugPrivilege 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe Token: SeDebugPrivilege 488 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.8711.15068.exeRegSvcs.exedescription pid process target process PID 1644 wrote to memory of 488 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe powershell.exe PID 1644 wrote to memory of 488 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe powershell.exe PID 1644 wrote to memory of 488 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe powershell.exe PID 1644 wrote to memory of 5076 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe schtasks.exe PID 1644 wrote to memory of 5076 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe schtasks.exe PID 1644 wrote to memory of 5076 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe schtasks.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1644 wrote to memory of 1616 1644 SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe RegSvcs.exe PID 1616 wrote to memory of 2696 1616 RegSvcs.exe Host.exe PID 1616 wrote to memory of 2696 1616 RegSvcs.exe Host.exe PID 1616 wrote to memory of 2696 1616 RegSvcs.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8711.15068.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\abmJUJB.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:488 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\abmJUJB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp30D.tmp"2⤵
- Creates scheduled task(s)
PID:5076 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
PID:2696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp30D.tmpFilesize
1KB
MD5d7627f656edadd37d192f0fa5951c7d6
SHA169a3b804708ce3ef46b36231ac500be60d099700
SHA2566c3667f21ce26b6a35b683c3e131281e98c65411a2eddbb5d3cafe53567ec8aa
SHA5126e17f82c736a2390f083932ed74909fe103b7f4faedfb0cd1e41a058685e50415b94950a54d205f561e00f7b298c2bfa188a7073b4019170dd1d9b7727a7c096
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
memory/488-148-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/488-157-0x00000000759E0000-0x0000000075A2C000-memory.dmpFilesize
304KB
-
memory/488-164-0x0000000007B00000-0x0000000007B1A000-memory.dmpFilesize
104KB
-
memory/488-163-0x00000000079F0000-0x00000000079FE000-memory.dmpFilesize
56KB
-
memory/488-139-0x0000000002BC0000-0x0000000002BF6000-memory.dmpFilesize
216KB
-
memory/488-162-0x0000000007A40000-0x0000000007AD6000-memory.dmpFilesize
600KB
-
memory/488-141-0x0000000005850000-0x0000000005E78000-memory.dmpFilesize
6.2MB
-
memory/488-161-0x0000000007830000-0x000000000783A000-memory.dmpFilesize
40KB
-
memory/488-160-0x00000000077C0000-0x00000000077DA000-memory.dmpFilesize
104KB
-
memory/488-159-0x0000000007E00000-0x000000000847A000-memory.dmpFilesize
6.5MB
-
memory/488-146-0x0000000005510000-0x0000000005532000-memory.dmpFilesize
136KB
-
memory/488-158-0x0000000006A50000-0x0000000006A6E000-memory.dmpFilesize
120KB
-
memory/488-147-0x00000000057B0000-0x0000000005816000-memory.dmpFilesize
408KB
-
memory/488-156-0x0000000006A70000-0x0000000006AA2000-memory.dmpFilesize
200KB
-
memory/488-137-0x0000000000000000-mapping.dmp
-
memory/488-165-0x0000000007AE0000-0x0000000007AE8000-memory.dmpFilesize
32KB
-
memory/488-155-0x00000000064A0000-0x00000000064BE000-memory.dmpFilesize
120KB
-
memory/1616-142-0x0000000000000000-mapping.dmp
-
memory/1616-143-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1616-151-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1616-145-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1616-144-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1644-133-0x00000000055B0000-0x0000000005B54000-memory.dmpFilesize
5.6MB
-
memory/1644-132-0x00000000005D0000-0x0000000000688000-memory.dmpFilesize
736KB
-
memory/1644-135-0x0000000005050000-0x000000000505A000-memory.dmpFilesize
40KB
-
memory/1644-136-0x0000000008D00000-0x0000000008D9C000-memory.dmpFilesize
624KB
-
memory/1644-134-0x00000000050A0000-0x0000000005132000-memory.dmpFilesize
584KB
-
memory/2696-153-0x0000000000670000-0x000000000067E000-memory.dmpFilesize
56KB
-
memory/2696-149-0x0000000000000000-mapping.dmp
-
memory/2696-154-0x0000000004E60000-0x0000000004E9C000-memory.dmpFilesize
240KB
-
memory/5076-138-0x0000000000000000-mapping.dmp