Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:37
Static task
static1
Behavioral task
behavioral1
Sample
Proof Of Payment.exe
Resource
win7v20201028
General
-
Target
Proof Of Payment.exe
-
Size
1.4MB
-
MD5
b09c19f4d896b873476bce03ff91207f
-
SHA1
2d10ce9d6635ba0bc7787bc25e83f91e6c138a38
-
SHA256
c8dd40f09de4d85fa155fab0b763b1cba2d8381617eee03932d0edd221c33fef
-
SHA512
367341a093421f25f560ac9cc2d5e36932af225a72fc5ee8af9d7f1135f6f4f4d135d9bd927203979be4bcccbc3559e558190b4ecdc43d7502205131af0b15ea
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1724-11-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1724-12-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1724-14-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proof Of Payment.exedescription pid process target process PID 1832 set thread context of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Proof Of Payment.exepid process 1832 Proof Of Payment.exe 1832 Proof Of Payment.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Proof Of Payment.exedescription pid process Token: SeDebugPrivilege 1832 Proof Of Payment.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Proof Of Payment.exedescription pid process target process PID 1832 wrote to memory of 1548 1832 Proof Of Payment.exe schtasks.exe PID 1832 wrote to memory of 1548 1832 Proof Of Payment.exe schtasks.exe PID 1832 wrote to memory of 1548 1832 Proof Of Payment.exe schtasks.exe PID 1832 wrote to memory of 1548 1832 Proof Of Payment.exe schtasks.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe PID 1832 wrote to memory of 1724 1832 Proof Of Payment.exe Proof Of Payment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proof Of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof Of Payment.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nhNlECm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1767.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Proof Of Payment.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1767.tmpMD5
33a8d506b1106da8af48283ca44ad635
SHA14c055533fe2dae18975d2fbad01ed83a0c68373a
SHA256ba002599b170c042ae34f5d8082907835166b79e8afccfc7a5918309f9e7c3cb
SHA5123d23ad0a45ef41e7c748f523f8fa5241055bb7865d956a9c17d28d3425c8c0b7a48b3a99e7841be40b855dcf823803c663d25ef1a63f04c8c2f57e1be89ba99c
-
memory/1548-9-0x0000000000000000-mapping.dmp
-
memory/1724-11-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1724-12-0x000000000040242D-mapping.dmp
-
memory/1724-13-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/1724-14-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1832-2-0x00000000749E0000-0x00000000750CE000-memory.dmpFilesize
6.9MB
-
memory/1832-3-0x0000000001310000-0x0000000001311000-memory.dmpFilesize
4KB
-
memory/1832-5-0x0000000000700000-0x0000000000776000-memory.dmpFilesize
472KB
-
memory/1832-6-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1832-7-0x0000000000510000-0x000000000051E000-memory.dmpFilesize
56KB
-
memory/1832-8-0x0000000004E00000-0x0000000004E56000-memory.dmpFilesize
344KB