Analysis
-
max time kernel
72s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 18:13
Static task
static1
Behavioral task
behavioral1
Sample
OrderNo-202000125.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
OrderNo-202000125.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
OrderNo-202000125.exe
-
Size
836KB
-
MD5
8768f782c4b33518acab30685d3106dc
-
SHA1
41fbeffbc5853d803a64b3a00b2b95fce72d0bbc
-
SHA256
cb9713e99535b6589f62d352c0a22488ae19d4b02df7f33e3fc052e9c8414481
-
SHA512
6e654f085f7047638d2720e9b58607558e273f04a52231ae05fee67ed73f4b061ef0638089fa72a321a99a787cf3f4cc1ae471c7f3bc5bb064001aec0faa9344
Score
10/10
Malware Config
Signatures
-
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2900-13-0x0000000000D00000-0x0000000000D33000-memory.dmp netwire -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
OrderNo-202000125.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Saspm = "C:\\Users\\Admin\\mpsaS.url" OrderNo-202000125.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 16 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
OrderNo-202000125.exepid process 800 OrderNo-202000125.exe 800 OrderNo-202000125.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
OrderNo-202000125.exedescription pid process target process PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe PID 800 wrote to memory of 2900 800 OrderNo-202000125.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OrderNo-202000125.exe"C:\Users\Admin\AppData\Local\Temp\OrderNo-202000125.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-2-0x0000000000770000-0x0000000000771000-memory.dmpFilesize
4KB
-
memory/2900-4-0x0000000000000000-mapping.dmp
-
memory/2900-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/2900-5-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/2900-7-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/2900-12-0x0000000010550000-0x0000000010585000-memory.dmpFilesize
212KB
-
memory/2900-13-0x0000000000D00000-0x0000000000D33000-memory.dmpFilesize
204KB