Overview

overview

10

Static

static

SecuriteIn...22.exe

windows7-x64

10

SecuriteIn...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    20-01-2023 09:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe

  • Size

    890KB

  • MD5

    04b48402ad5185ef1565a3fb9bf1aefe

  • SHA1

    06ad32d4b8b1ac735077dc9e7768eb649df4cb97

  • SHA256

    26f3ec45fc6fe6c84d815288a447499ef507c6a8b0f3abc473bfbc69eaf20c49

  • SHA512

    529e8d73a20a6af6d8836c2e2c44a286c013bf333f51fbd6b08598cc02d9bf5c95eb2b9aa8fa16310ff7650a5a5ba2eaf03ed08ceed2d90b5287a0a9dad56fb5

  • SSDEEP

    12288:kQdIxEnJFilzPypo07HoRyvviQ4kAVyEe8SwOylum:pexEjOPy+RP5lguO9m

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3361

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Telkomsa@1991

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 8 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lSDctUklJYlmEU.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:932
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lSDctUklJYlmEU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA610.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:664
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"
      2⤵
        PID:1264
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"
        2⤵
          PID:1828

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Credential Access

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmpA610.tmp
        Filesize

        1KB

        MD5

        caea0f05039588b8e9a346aa8243aa48

        SHA1

        9bd938a16a6f931bf6f7836ad5654712f27c9e7a

        SHA256

        45b829f419f600d8ad489d8be358c87655cbe165844add0c29ab73b19b9ecea8

        SHA512

        e12c00de996cbc386c15a61e5282d67c8d0d96c418fa4695e33bf6d8ffa6f654850fd45424275ebddda6d521ec10116dfa6ac65600073782840dfc0862799664

        Download Submit
      • memory/664-60-0x0000000000000000-mapping.dmp
        Download
      • memory/932-59-0x0000000000000000-mapping.dmp
        Download
      • memory/932-81-0x000000006E550000-0x000000006EAFB000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/932-79-0x000000006E550000-0x000000006EAFB000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/1828-67-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-74-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-82-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-80-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-64-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-78-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-69-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-72-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-70-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-65-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

        Download
      • memory/1828-75-0x00000000004026D0-mapping.dmp
        Download
      • memory/2008-54-0x0000000000DB0000-0x0000000000E94000-memory.dmp
        Filesize

        912KB

        Download
      • memory/2008-58-0x0000000004F90000-0x0000000004FF2000-memory.dmp
        Filesize

        392KB

        Download
      • memory/2008-56-0x0000000000510000-0x0000000000526000-memory.dmp
        Filesize

        88KB

        Download
      • memory/2008-63-0x0000000004C40000-0x0000000004C68000-memory.dmp
        Filesize

        160KB

        Download
      • memory/2008-55-0x00000000760C1000-0x00000000760C3000-memory.dmp
        Filesize

        8KB

        Download
      • memory/2008-57-0x00000000009F0000-0x00000000009FA000-memory.dmp
        Filesize

        40KB

        Download