Analysis
-
max time kernel
172s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 10:30
Static task
static1
Behavioral task
behavioral1
Sample
Proof of Payment.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Proof of Payment.exe
Resource
win10v2004-20220414-en
General
-
Target
Proof of Payment.exe
-
Size
1.1MB
-
MD5
5c145bcd4ec07ab79558d72affbed677
-
SHA1
85cc76ba184adde81799ef4174d2412aba7c8dfd
-
SHA256
90bb157f9c5241f567eb56be38e3ba9f51a0ec5a8da3c77fdb1bed1f2095c39b
-
SHA512
24c11205a6ac4470890e68111d2a398dd60e76201ecf8f5f9c7069f76d818a432b5ae48279c2711070c7788afe8508d6983afe5fa41038fd38da9689b83691bd
Malware Config
Extracted
netwire
194.5.98.225:3373
194.5.98.225:3376
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
good01230123
-
registry_autorun
false
- startup_name
-
use_mutex
false
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1484-67-0x00000000002D0000-0x00000000007D0000-memory.dmp netwire behavioral1/memory/1484-68-0x00000000002D242D-mapping.dmp netwire behavioral1/memory/1484-72-0x00000000002D0000-0x00000000007D0000-memory.dmp netwire behavioral1/memory/1484-73-0x00000000002D0000-0x00000000007D0000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
ghjn.pifRegSvcs.exepid process 108 ghjn.pif 1484 RegSvcs.exe -
Loads dropped DLL 5 IoCs
Processes:
Proof of Payment.exeghjn.pifpid process 2024 Proof of Payment.exe 2024 Proof of Payment.exe 2024 Proof of Payment.exe 2024 Proof of Payment.exe 108 ghjn.pif -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ghjn.pifdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ghjn.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\66767400\\ghjn.pif C:\\Users\\Admin\\AppData\\Roaming\\66767400\\qfcaxr.oci" ghjn.pif -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ghjn.pifdescription pid process target process PID 108 set thread context of 1484 108 ghjn.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ghjn.pifpid process 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif 108 ghjn.pif -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Proof of Payment.exeghjn.pifdescription pid process target process PID 2024 wrote to memory of 108 2024 Proof of Payment.exe ghjn.pif PID 2024 wrote to memory of 108 2024 Proof of Payment.exe ghjn.pif PID 2024 wrote to memory of 108 2024 Proof of Payment.exe ghjn.pif PID 2024 wrote to memory of 108 2024 Proof of Payment.exe ghjn.pif PID 108 wrote to memory of 1484 108 ghjn.pif RegSvcs.exe PID 108 wrote to memory of 1484 108 ghjn.pif RegSvcs.exe PID 108 wrote to memory of 1484 108 ghjn.pif RegSvcs.exe PID 108 wrote to memory of 1484 108 ghjn.pif RegSvcs.exe PID 108 wrote to memory of 1484 108 ghjn.pif RegSvcs.exe PID 108 wrote to memory of 1484 108 ghjn.pif RegSvcs.exe PID 108 wrote to memory of 1484 108 ghjn.pif RegSvcs.exe PID 108 wrote to memory of 1484 108 ghjn.pif RegSvcs.exe PID 108 wrote to memory of 1484 108 ghjn.pif RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\66767400\ghjn.pif"C:\Users\Admin\AppData\Roaming\66767400\ghjn.pif" qfcaxr.oci2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\66767400\aifgsme.jpgFilesize
378KB
MD5fd8639db7eb6aa82d843d0055f7b577e
SHA1c128aeb9bdc2afc42a7f2fb6b1569c0445c9ca9f
SHA256c29da3eda2910518a9a93a621288cc85985659f17dae2c3f035906512effd632
SHA512d33ef0f326a8b6803e8a23e97966035e198f725fa59fe4187002ad1c4909be0e6f2b74f0d9cccbced3f40cb0918e71f81c8daeec0210309dd381916db5fec340
-
C:\Users\Admin\AppData\Roaming\66767400\ghjn.pifFilesize
712KB
MD543e7db53ce5c130179aef5b47dcf7608
SHA15398e207d9ad301860b570d87601c1664ada9c0a
SHA2569c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1
SHA512a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4
-
C:\Users\Admin\AppData\Roaming\66767400\qfcaxr.ociFilesize
215.6MB
MD50e8f1ec86ac14d2ca746ae43d32d9b69
SHA158236722578d35b7849605b33ac8ffa779c29308
SHA256a0404937068f439cace281578e4f3e1fd674f934f8f56cfe50296a9cd5397471
SHA5126fb24fe879f3d8038335331fbcf3e701259a6d1419ff142b9e792e72b5664a0366c79d45af51a413c500b5a6ecc3ee87a8d247179448e79a69a8360d70184fd8
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\66767400\ghjn.pifFilesize
712KB
MD543e7db53ce5c130179aef5b47dcf7608
SHA15398e207d9ad301860b570d87601c1664ada9c0a
SHA2569c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1
SHA512a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4
-
\Users\Admin\AppData\Roaming\66767400\ghjn.pifFilesize
712KB
MD543e7db53ce5c130179aef5b47dcf7608
SHA15398e207d9ad301860b570d87601c1664ada9c0a
SHA2569c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1
SHA512a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4
-
\Users\Admin\AppData\Roaming\66767400\ghjn.pifFilesize
712KB
MD543e7db53ce5c130179aef5b47dcf7608
SHA15398e207d9ad301860b570d87601c1664ada9c0a
SHA2569c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1
SHA512a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4
-
\Users\Admin\AppData\Roaming\66767400\ghjn.pifFilesize
712KB
MD543e7db53ce5c130179aef5b47dcf7608
SHA15398e207d9ad301860b570d87601c1664ada9c0a
SHA2569c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1
SHA512a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4
-
memory/108-59-0x0000000000000000-mapping.dmp
-
memory/1484-65-0x00000000002D0000-0x00000000007D0000-memory.dmpFilesize
5.0MB
-
memory/1484-67-0x00000000002D0000-0x00000000007D0000-memory.dmpFilesize
5.0MB
-
memory/1484-68-0x00000000002D242D-mapping.dmp
-
memory/1484-72-0x00000000002D0000-0x00000000007D0000-memory.dmpFilesize
5.0MB
-
memory/1484-73-0x00000000002D0000-0x00000000007D0000-memory.dmpFilesize
5.0MB
-
memory/2024-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB