Analysis
-
max time kernel
114s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-07-2021 09:11
Static task
static1
Behavioral task
behavioral1
Sample
proof of payment.scr.exe
Resource
win7v20210410
General
-
Target
proof of payment.scr.exe
-
Size
873KB
-
MD5
693fc4eb901d82a09678e506960fd24d
-
SHA1
8fcfb6ea44062af4557b2820591f75126b5edf81
-
SHA256
59fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
-
SHA512
0c076cf5b30edb1c8f51c11e52778cd20eaf88736467e1c0f401b48154ae54ed31433efa898c0be883bab6a9ed435540d16974858eb691410787f787870d464a
Malware Config
Extracted
netwire
harold.ns01.info:3606
-
activex_autorun
false
- activex_key
-
copy_executable
true
-
delete_original
false
-
host_id
Ojoko
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
enbSUNvD
-
offline_keylogger
true
-
password
master12
-
registry_autorun
false
- startup_name
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2100-126-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2100-127-0x000000000040242D-mapping.dmp netwire behavioral2/memory/2100-136-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3492-146-0x000000000040242D-mapping.dmp netwire behavioral2/memory/3492-148-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 3 IoCs
Processes:
Host.exeHost.exeHost.exepid process 3796 Host.exe 3108 Host.exe 3492 Host.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
proof of payment.scr.exeHost.exedescription pid process target process PID 628 set thread context of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 3796 set thread context of 3492 3796 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2752 schtasks.exe 3104 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Host.exepid process 3796 Host.exe 3796 Host.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Host.exedescription pid process Token: SeDebugPrivilege 3796 Host.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
proof of payment.scr.exeproof of payment.scr.exeHost.exedescription pid process target process PID 628 wrote to memory of 2752 628 proof of payment.scr.exe schtasks.exe PID 628 wrote to memory of 2752 628 proof of payment.scr.exe schtasks.exe PID 628 wrote to memory of 2752 628 proof of payment.scr.exe schtasks.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 628 wrote to memory of 2100 628 proof of payment.scr.exe proof of payment.scr.exe PID 2100 wrote to memory of 3796 2100 proof of payment.scr.exe Host.exe PID 2100 wrote to memory of 3796 2100 proof of payment.scr.exe Host.exe PID 2100 wrote to memory of 3796 2100 proof of payment.scr.exe Host.exe PID 3796 wrote to memory of 3104 3796 Host.exe schtasks.exe PID 3796 wrote to memory of 3104 3796 Host.exe schtasks.exe PID 3796 wrote to memory of 3104 3796 Host.exe schtasks.exe PID 3796 wrote to memory of 3108 3796 Host.exe Host.exe PID 3796 wrote to memory of 3108 3796 Host.exe Host.exe PID 3796 wrote to memory of 3108 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe PID 3796 wrote to memory of 3492 3796 Host.exe Host.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\proof of payment.scr.exe"C:\Users\Admin\AppData\Local\Temp\proof of payment.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emYsBrAgw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2C31.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\proof of payment.scr.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emYsBrAgw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB101.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"{path}"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2C31.tmpMD5
07d9c693ca5337b83b5ca6b7b9b55e77
SHA1afc50ef9b04ed55b39641e5970f84e87ce7a8916
SHA256519021e2f979027e81395b66d9fe701d136932b4ebfcc84450736215fcbcb153
SHA51204ac4a4adec4852186a3443780da8acb42fef65f8bbb8fc75f04ed89f7dd3158e5862864232680400b7768c85e661b9010c8160791a4c3e49b83f5e26b64b638
-
C:\Users\Admin\AppData\Local\Temp\tmpB101.tmpMD5
07d9c693ca5337b83b5ca6b7b9b55e77
SHA1afc50ef9b04ed55b39641e5970f84e87ce7a8916
SHA256519021e2f979027e81395b66d9fe701d136932b4ebfcc84450736215fcbcb153
SHA51204ac4a4adec4852186a3443780da8acb42fef65f8bbb8fc75f04ed89f7dd3158e5862864232680400b7768c85e661b9010c8160791a4c3e49b83f5e26b64b638
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
693fc4eb901d82a09678e506960fd24d
SHA18fcfb6ea44062af4557b2820591f75126b5edf81
SHA25659fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
SHA5120c076cf5b30edb1c8f51c11e52778cd20eaf88736467e1c0f401b48154ae54ed31433efa898c0be883bab6a9ed435540d16974858eb691410787f787870d464a
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
693fc4eb901d82a09678e506960fd24d
SHA18fcfb6ea44062af4557b2820591f75126b5edf81
SHA25659fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
SHA5120c076cf5b30edb1c8f51c11e52778cd20eaf88736467e1c0f401b48154ae54ed31433efa898c0be883bab6a9ed435540d16974858eb691410787f787870d464a
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
693fc4eb901d82a09678e506960fd24d
SHA18fcfb6ea44062af4557b2820591f75126b5edf81
SHA25659fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
SHA5120c076cf5b30edb1c8f51c11e52778cd20eaf88736467e1c0f401b48154ae54ed31433efa898c0be883bab6a9ed435540d16974858eb691410787f787870d464a
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeMD5
693fc4eb901d82a09678e506960fd24d
SHA18fcfb6ea44062af4557b2820591f75126b5edf81
SHA25659fc44577bd89c7f6ae86b0b13e7e19c4d17612b4d5696e6c70d2e88d5d8115e
SHA5120c076cf5b30edb1c8f51c11e52778cd20eaf88736467e1c0f401b48154ae54ed31433efa898c0be883bab6a9ed435540d16974858eb691410787f787870d464a
-
memory/628-118-0x0000000004B10000-0x0000000004BA2000-memory.dmpFilesize
584KB
-
memory/628-122-0x0000000006E60000-0x0000000006F17000-memory.dmpFilesize
732KB
-
memory/628-123-0x0000000006CC0000-0x0000000006D2B000-memory.dmpFilesize
428KB
-
memory/628-121-0x0000000004DF0000-0x0000000004DF2000-memory.dmpFilesize
8KB
-
memory/628-120-0x0000000006FE0000-0x0000000006FE1000-memory.dmpFilesize
4KB
-
memory/628-119-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/628-114-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/628-117-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/628-116-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/2100-127-0x000000000040242D-mapping.dmp
-
memory/2100-136-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2100-126-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2752-124-0x0000000000000000-mapping.dmp
-
memory/3104-142-0x0000000000000000-mapping.dmp
-
memory/3492-146-0x000000000040242D-mapping.dmp
-
memory/3492-148-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3796-138-0x0000000004F90000-0x000000000548E000-memory.dmpFilesize
5.0MB
-
memory/3796-128-0x0000000000000000-mapping.dmp