Analysis
-
max time kernel
36s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 07:22
Static task
static1
Behavioral task
behavioral1
Sample
Proof of Payment.exe
Resource
win7v20201028
General
-
Target
Proof of Payment.exe
-
Size
919KB
-
MD5
06eea001fb61532885ae0ce6f95d0b3c
-
SHA1
0cd7c9f2abdd2558333541762903d2f8328dec96
-
SHA256
2dc1258101b1183ad4e08320f15310cad541c900919e98e0816c751fee303306
-
SHA512
1bd704ab322497ffc5212aed7283819253113b4f2e306b0f3a8d1eec2d4cb302d3007c859877284d31c988917c712f652bdede16c7fb489568293c28e3860c21
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/728-13-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/728-14-0x000000000040242D-mapping.dmp netwire behavioral2/memory/728-15-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proof of Payment.exedescription pid process target process PID 756 set thread context of 728 756 Proof of Payment.exe Proof of Payment.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Proof of Payment.exepid process 756 Proof of Payment.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Proof of Payment.exedescription pid process Token: SeDebugPrivilege 756 Proof of Payment.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Proof of Payment.exedescription pid process target process PID 756 wrote to memory of 1096 756 Proof of Payment.exe schtasks.exe PID 756 wrote to memory of 1096 756 Proof of Payment.exe schtasks.exe PID 756 wrote to memory of 1096 756 Proof of Payment.exe schtasks.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe PID 756 wrote to memory of 728 756 Proof of Payment.exe Proof of Payment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pmbtKQaVLTRS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC394.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC394.tmpMD5
b14631b8db0e1bfa0772b72e56cf605d
SHA13ea002ac46506f874a57cb419f3e1d7fe5857c73
SHA256b49c9f6ac5b01644800802a59c53cd77295c75e6257367cd01811816128204ed
SHA512fb8f877e4507692f3a969960c63bc4e8f25e02f9c05f432d383bb79a4b03475aea477e64841fe667add786edc370a86b2836b284126a307efb2b9f68bbdacf9e
-
memory/728-15-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/728-14-0x000000000040242D-mapping.dmp
-
memory/728-13-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/756-6-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/756-8-0x0000000005770000-0x000000000577E000-memory.dmpFilesize
56KB
-
memory/756-9-0x00000000062B0000-0x00000000062F6000-memory.dmpFilesize
280KB
-
memory/756-10-0x0000000006400000-0x0000000006401000-memory.dmpFilesize
4KB
-
memory/756-7-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/756-2-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/756-5-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/756-3-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/1096-11-0x0000000000000000-mapping.dmp