Overview

overview

10

Static

static

SecuriteIn...22.exe

windows7-x64

10

SecuriteIn...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-01-2023 09:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe

  • Size

    890KB

  • MD5

    04b48402ad5185ef1565a3fb9bf1aefe

  • SHA1

    06ad32d4b8b1ac735077dc9e7768eb649df4cb97

  • SHA256

    26f3ec45fc6fe6c84d815288a447499ef507c6a8b0f3abc473bfbc69eaf20c49

  • SHA512

    529e8d73a20a6af6d8836c2e2c44a286c013bf333f51fbd6b08598cc02d9bf5c95eb2b9aa8fa16310ff7650a5a5ba2eaf03ed08ceed2d90b5287a0a9dad56fb5

  • SSDEEP

    12288:kQdIxEnJFilzPypo07HoRyvviQ4kAVyEe8SwOylum:pexEjOPy+RP5lguO9m

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

212.193.30.230:3361

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Telkomsa@1991

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 4 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lSDctUklJYlmEU.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3340
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lSDctUklJYlmEU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBF6.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3780
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Krypt-TF.(On.Demand).3002.6722.exe"
      2⤵
        PID:3892

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpBF6.tmp
      Filesize

      1KB

      MD5

      4db404b36633c1a8bfef740e10259393

      SHA1

      4c500d3e3776b39d75da3036c872a83b12edc3cb

      SHA256

      8956cf52c27e0fe2cf4b75309074a897126f3de6131937816cea954cb5d08246

      SHA512

      b302a434b5ad35143b826c87fcea2f7c49c6a846b52c8df53e61dbcba813cd38b9a757d856725fc10d57a11852530ef2207ba824c6274c2c4e5e02a7e4525c09

      Download Submit
    • memory/1136-133-0x00000000053C0000-0x0000000005964000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/1136-134-0x0000000004EB0000-0x0000000004F42000-memory.dmp
      Filesize

      584KB

      Download
    • memory/1136-135-0x0000000004E90000-0x0000000004E9A000-memory.dmp
      Filesize

      40KB

      Download
    • memory/1136-136-0x0000000007630000-0x00000000076CC000-memory.dmp
      Filesize

      624KB

      Download
    • memory/1136-132-0x00000000003F0000-0x00000000004D4000-memory.dmp
      Filesize

      912KB

      Download
    • memory/3340-147-0x0000000005F90000-0x0000000005FF6000-memory.dmp
      Filesize

      408KB

      Download
    • memory/3340-155-0x0000000007B80000-0x0000000007B9A000-memory.dmp
      Filesize

      104KB

      Download
    • memory/3340-160-0x0000000007EA0000-0x0000000007EA8000-memory.dmp
      Filesize

      32KB

      Download
    • memory/3340-143-0x0000000005960000-0x0000000005F88000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/3340-159-0x0000000007EC0000-0x0000000007EDA000-memory.dmp
      Filesize

      104KB

      Download
    • memory/3340-158-0x0000000007DB0000-0x0000000007DBE000-memory.dmp
      Filesize

      56KB

      Download
    • memory/3340-157-0x0000000007E00000-0x0000000007E96000-memory.dmp
      Filesize

      600KB

      Download
    • memory/3340-146-0x00000000057B0000-0x00000000057D2000-memory.dmp
      Filesize

      136KB

      Download
    • memory/3340-137-0x0000000000000000-mapping.dmp
      Download
    • memory/3340-148-0x0000000006240000-0x00000000062A6000-memory.dmp
      Filesize

      408KB

      Download
    • memory/3340-156-0x0000000007BF0000-0x0000000007BFA000-memory.dmp
      Filesize

      40KB

      Download
    • memory/3340-150-0x0000000006880000-0x000000000689E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/3340-151-0x0000000007850000-0x0000000007882000-memory.dmp
      Filesize

      200KB

      Download
    • memory/3340-152-0x00000000707D0000-0x000000007081C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/3340-153-0x0000000006E10000-0x0000000006E2E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/3340-154-0x00000000081D0000-0x000000000884A000-memory.dmp
      Filesize

      6.5MB

      Download
    • memory/3340-139-0x0000000002F50000-0x0000000002F86000-memory.dmp
      Filesize

      216KB

      Download
    • memory/3780-138-0x0000000000000000-mapping.dmp
      Download
    • memory/3892-149-0x0000000000400000-0x000000000042B000-memory.dmp
      Filesize

      172KB

      Download
    • memory/3892-145-0x0000000000400000-0x000000000042B000-memory.dmp
      Filesize

      172KB

      Download
    • memory/3892-141-0x0000000000000000-mapping.dmp
      Download
    • memory/3892-142-0x0000000000400000-0x000000000042B000-memory.dmp
      Filesize

      172KB

      Download
    • memory/3892-161-0x0000000000400000-0x000000000042B000-memory.dmp
      Filesize

      172KB

      Download