Analysis
-
max time kernel
95s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-07-2021 10:10
Static task
static1
Behavioral task
behavioral1
Sample
proof of payment.scr.exe
Resource
win7v20210408
General
-
Target
proof of payment.scr.exe
-
Size
873KB
-
MD5
693fc4eb901d82a09678e506960fd24d
-
SHA1
8fcfb6ea44062af4557b2820591f75126b5edf81
-
SHA256
59fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
-
SHA512
0c076cf5b30edb1c8f51c11e52778cd20eaf88736467e1c0f401b48154ae54ed31433efa898c0be883bab6a9ed435540d16974858eb691410787f787870d464a
Malware Config
Extracted
netwire
harold.ns01.info:3606
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
false
-
host_id
Ojoko
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
enbSUNvD
-
offline_keylogger
true
-
password
master12
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/836-126-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/836-127-0x000000000040242D-mapping.dmp netwire behavioral2/memory/1840-139-0x0000000004CE0000-0x00000000051DE000-memory.dmp netwire behavioral2/memory/836-138-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2200-145-0x000000000040242D-mapping.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
Host.exeHost.exepid process 1840 Host.exe 2200 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
proof of payment.scr.exeHost.exedescription pid process target process PID 3908 set thread context of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 1840 set thread context of 2200 1840 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2100 schtasks.exe 2460 schtasks.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
proof of payment.scr.exeproof of payment.scr.exeHost.exedescription pid process target process PID 3908 wrote to memory of 2100 3908 proof of payment.scr.exe schtasks.exe PID 3908 wrote to memory of 2100 3908 proof of payment.scr.exe schtasks.exe PID 3908 wrote to memory of 2100 3908 proof of payment.scr.exe schtasks.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 3908 wrote to memory of 836 3908 proof of payment.scr.exe proof of payment.scr.exe PID 836 wrote to memory of 1840 836 proof of payment.scr.exe Host.exe PID 836 wrote to memory of 1840 836 proof of payment.scr.exe Host.exe PID 836 wrote to memory of 1840 836 proof of payment.scr.exe Host.exe PID 1840 wrote to memory of 2460 1840 Host.exe schtasks.exe PID 1840 wrote to memory of 2460 1840 Host.exe schtasks.exe PID 1840 wrote to memory of 2460 1840 Host.exe schtasks.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe PID 1840 wrote to memory of 2200 1840 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\proof of payment.scr.exe"C:\Users\Admin\AppData\Local\Temp\proof of payment.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emYsBrAgw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp96E6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\proof of payment.scr.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emYsBrAgw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp17AF.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp17AF.tmpMD5
fcd4c3af61fd9d3dbff283ce56c92ec8
SHA147eb73243406f084ab1671fb8f169731dde1fb9c
SHA2569e0d491c2c838b75548ffdc05d1a9d3f1d735864544594ec4051768fbd2ec3a3
SHA5120106d8bfb139f9257688132e7ec07be8989268b46fa013c032a037a82baf38aaea87ac9699fea15876af356db6eb0550c0fb33989794f728dc9a886d8dc482a8
-
C:\Users\Admin\AppData\Local\Temp\tmp96E6.tmpMD5
fcd4c3af61fd9d3dbff283ce56c92ec8
SHA147eb73243406f084ab1671fb8f169731dde1fb9c
SHA2569e0d491c2c838b75548ffdc05d1a9d3f1d735864544594ec4051768fbd2ec3a3
SHA5120106d8bfb139f9257688132e7ec07be8989268b46fa013c032a037a82baf38aaea87ac9699fea15876af356db6eb0550c0fb33989794f728dc9a886d8dc482a8
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
693fc4eb901d82a09678e506960fd24d
SHA18fcfb6ea44062af4557b2820591f75126b5edf81
SHA25659fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
SHA5120c076cf5b30edb1c8f51c11e52778cd20eaf88736467e1c0f401b48154ae54ed31433efa898c0be883bab6a9ed435540d16974858eb691410787f787870d464a
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
693fc4eb901d82a09678e506960fd24d
SHA18fcfb6ea44062af4557b2820591f75126b5edf81
SHA25659fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
SHA5120c076cf5b30edb1c8f51c11e52778cd20eaf88736467e1c0f401b48154ae54ed31433efa898c0be883bab6a9ed435540d16974858eb691410787f787870d464a
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
693fc4eb901d82a09678e506960fd24d
SHA18fcfb6ea44062af4557b2820591f75126b5edf81
SHA25659fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
SHA5120c076cf5b30edb1c8f51c11e52778cd20eaf88736467e1c0f401b48154ae54ed31433efa898c0be883bab6a9ed435540d16974858eb691410787f787870d464a
-
memory/836-126-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/836-138-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/836-127-0x000000000040242D-mapping.dmp
-
memory/1840-139-0x0000000004CE0000-0x00000000051DE000-memory.dmpFilesize
5.0MB
-
memory/1840-128-0x0000000000000000-mapping.dmp
-
memory/2100-124-0x0000000000000000-mapping.dmp
-
memory/2200-145-0x000000000040242D-mapping.dmp
-
memory/2460-142-0x0000000000000000-mapping.dmp
-
memory/3908-122-0x0000000007560000-0x0000000007617000-memory.dmpFilesize
732KB
-
memory/3908-117-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/3908-114-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/3908-119-0x0000000004E60000-0x000000000535E000-memory.dmpFilesize
5.0MB
-
memory/3908-121-0x0000000005220000-0x0000000005222000-memory.dmpFilesize
8KB
-
memory/3908-123-0x00000000073C0000-0x000000000742B000-memory.dmpFilesize
428KB
-
memory/3908-116-0x0000000005360000-0x0000000005361000-memory.dmpFilesize
4KB
-
memory/3908-118-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/3908-120-0x0000000006F30000-0x0000000006F31000-memory.dmpFilesize
4KB