Analysis
-
max time kernel
132s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-12-2020 08:41
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDERS.exe
Resource
win7v20201028
General
-
Target
NEW ORDERS.exe
-
Size
587KB
-
MD5
25db6bf1906d3f8e82f2e0be5c84cce5
-
SHA1
b25465a07d80934f44c4f94c87848c19aeaa4dec
-
SHA256
21b720127c08d4ba7b5fe44f6c1f555db9b2b98a3adc53b9f63a2fe63e6e5ead
-
SHA512
6edb791a243b845d6dcd6226207a6a5196e01a9cd21c6d3bd6c6c03ba263ae077a18c62d7935a01ac764621fa107a9c5aefb376f2f35c05d86134b5dab0c62ad
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/416-9-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral1/memory/416-10-0x00000000004026D0-mapping.dmp netwire behavioral1/memory/416-11-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW ORDERS.exedescription pid process target process PID 868 set thread context of 416 868 NEW ORDERS.exe NEW ORDERS.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEW ORDERS.exedescription pid process target process PID 868 wrote to memory of 1556 868 NEW ORDERS.exe schtasks.exe PID 868 wrote to memory of 1556 868 NEW ORDERS.exe schtasks.exe PID 868 wrote to memory of 1556 868 NEW ORDERS.exe schtasks.exe PID 868 wrote to memory of 1556 868 NEW ORDERS.exe schtasks.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe PID 868 wrote to memory of 416 868 NEW ORDERS.exe NEW ORDERS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDERS.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDERS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HPeNXWq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp213.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDERS.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp213.tmpMD5
d5d8a3c48f816f3342b64429c9a81a4f
SHA13385ea1b0fd975b98a43f6c17a66c8cc0b1cee9a
SHA2562bd6bcc31bc0ac681b47ae4dceb2582cc510fb0a0236f28cbad9d42aba90c4a1
SHA512a34297519ec36eb76b56ff164b95681260cb606e574adf4f3a5f5606ce38af4989a12bfd56decb18e0d577197909cb755b32a4325714544f7e75e7f2661d69fb
-
memory/416-9-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/416-10-0x00000000004026D0-mapping.dmp
-
memory/416-11-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/868-2-0x00000000741E0000-0x00000000748CE000-memory.dmpFilesize
6.9MB
-
memory/868-3-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/868-5-0x0000000000430000-0x0000000000434000-memory.dmpFilesize
16KB
-
memory/868-6-0x0000000005CC0000-0x0000000005D4D000-memory.dmpFilesize
564KB
-
memory/1556-7-0x0000000000000000-mapping.dmp