Analysis
-
max time kernel
41s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:36
Static task
static1
Behavioral task
behavioral1
Sample
Proof of Payment.exe
Resource
win7v20201028
General
-
Target
Proof of Payment.exe
-
Size
1.4MB
-
MD5
630c736f4a8124225065b21a153b889d
-
SHA1
c84d8e6cd5218bdc77b5511a7b38cd94c02fa463
-
SHA256
ef9e50bbc71c2f7c213f49e413cebab25733d52f82f2197ab256471ecb3db3bf
-
SHA512
97f4b9f5d5721f8410fb57b2a97f706cef64ad2e9c10a54918dde5a8842c56a59c1cfe1b2aec2d5c889f71612d32045b8c563828eb2d3f3da9284a82227edaa3
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/468-11-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/468-12-0x000000000040242D-mapping.dmp netwire behavioral1/memory/468-14-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proof of Payment.exedescription pid process target process PID 1724 set thread context of 468 1724 Proof of Payment.exe Proof of Payment.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Proof of Payment.exepid process 1724 Proof of Payment.exe 1724 Proof of Payment.exe 1724 Proof of Payment.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Proof of Payment.exedescription pid process Token: SeDebugPrivilege 1724 Proof of Payment.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Proof of Payment.exedescription pid process target process PID 1724 wrote to memory of 1536 1724 Proof of Payment.exe schtasks.exe PID 1724 wrote to memory of 1536 1724 Proof of Payment.exe schtasks.exe PID 1724 wrote to memory of 1536 1724 Proof of Payment.exe schtasks.exe PID 1724 wrote to memory of 1536 1724 Proof of Payment.exe schtasks.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe PID 1724 wrote to memory of 468 1724 Proof of Payment.exe Proof of Payment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iRNHgwxDoUcDgI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC4E5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC4E5.tmpMD5
5055461cccaf237d5d81b9865d9c7313
SHA1ac29bc15294f8e0b5357218b7174b596e42654e9
SHA2566401a31ea34ebac39512734be21547b9993b1d8f19705b738a3225187eea450a
SHA512174a84208af462887c5fa923d74df9fa1b50e6f94baf29e78c9cbfd18d59518d269139b87de7d42a2d8a199057834b3e50f50128e2ddf9461b2c12da547f1f52
-
memory/468-11-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/468-12-0x000000000040242D-mapping.dmp
-
memory/468-13-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/468-14-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1536-9-0x0000000000000000-mapping.dmp
-
memory/1724-2-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/1724-3-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/1724-5-0x00000000048C0000-0x0000000004938000-memory.dmpFilesize
480KB
-
memory/1724-6-0x0000000005D40000-0x0000000005D41000-memory.dmpFilesize
4KB
-
memory/1724-7-0x00000000005A0000-0x00000000005AE000-memory.dmpFilesize
56KB
-
memory/1724-8-0x0000000000760000-0x00000000007B7000-memory.dmpFilesize
348KB