Analysis
- max time kernel
134s - max time network
136s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/04/2021, 08:27
General
- Target Proof of Payment.exe
- Size 908KB
- Sample210427-vmf18wm2sx
- SHA256 e482d2b16ccf9f71c4eab5a33796d1059aed7be13d48e356752498257c437c29
Malware Config
Extracted
-
netwire
-
194.5.97.181:3383
-
194.5.97.181:3385
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
London@1961
-
registry_autorun
false
- startup_name
-
use_mutex
false
Signatures
- NetWire RAT payload 3 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VEEkABLZv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp468A.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/708-121-0x0000000005270000-0x000000000530C000-memory.dmp
memory/708-123-0x0000000007230000-0x00000000072D8000-memory.dmp
memory/708-118-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/708-119-0x00000000052A0000-0x00000000052A1000-memory.dmp
memory/708-120-0x0000000005570000-0x0000000005571000-memory.dmp
memory/708-114-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/708-122-0x0000000005870000-0x000000000587D000-memory.dmp
memory/708-117-0x00000000058B0000-0x00000000058B1000-memory.dmp
memory/708-124-0x0000000009880000-0x00000000098E8000-memory.dmp
memory/708-116-0x0000000005310000-0x0000000005311000-memory.dmp
memory/2104-127-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2104-129-0x0000000000400000-0x0000000000433000-memory.dmp