Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:03
Static task
static1
Behavioral task
behavioral1
Sample
15-08-2020 - SOFT COPY_PAYMENT SLIP.exe
Resource
win7-20220414-en
General
-
Target
15-08-2020 - SOFT COPY_PAYMENT SLIP.exe
-
Size
234KB
-
MD5
e792eb4a972110714df6761ef60284c6
-
SHA1
91bb096d730ca536a0f18534acdec271bdd0eefa
-
SHA256
b6f5a289ab47b790c1bc57a5a3b35871fc968da66ebb3fdd7669de18c2ba3dd5
-
SHA512
40ebe7bd5b18845710cfb3116888d16da8a9fd6c1d53a39000103feac45c1dfeaa4efa05104072313973d5fb87b62b06ea3c697513b4303c45124d020b22eead
Malware Config
Extracted
netwire
iphanyi.duckdns.org:3360
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
SMS_Group
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
caster123
-
registry_autorun
false
- startup_name
-
use_mutex
false
Signatures
-
NetWire RAT payload 11 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\tmp.exe netwire \Users\Admin\AppData\Local\Temp\tmp.exe netwire C:\Users\Admin\AppData\Local\Temp\tmp.exe netwire behavioral1/memory/816-67-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/816-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/816-68-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/816-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/816-73-0x000000000040242D-mapping.dmp netwire behavioral1/memory/816-72-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/816-77-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/816-84-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
tmp.exesvhost.exepid process 956 tmp.exe 816 svhost.exe -
Loads dropped DLL 3 IoCs
Processes:
15-08-2020 - SOFT COPY_PAYMENT SLIP.exepid process 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
15-08-2020 - SOFT COPY_PAYMENT SLIP.exedescription pid process target process PID 1564 set thread context of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1504 timeout.exe -
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\word.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
15-08-2020 - SOFT COPY_PAYMENT SLIP.exepid process 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
15-08-2020 - SOFT COPY_PAYMENT SLIP.exepid process 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
15-08-2020 - SOFT COPY_PAYMENT SLIP.exedescription pid process Token: SeDebugPrivilege 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
15-08-2020 - SOFT COPY_PAYMENT SLIP.execmd.execmd.exedescription pid process target process PID 1564 wrote to memory of 956 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe tmp.exe PID 1564 wrote to memory of 956 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe tmp.exe PID 1564 wrote to memory of 956 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe tmp.exe PID 1564 wrote to memory of 956 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe tmp.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 816 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe svhost.exe PID 1564 wrote to memory of 1992 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1992 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1992 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1992 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1992 wrote to memory of 1876 1992 cmd.exe reg.exe PID 1992 wrote to memory of 1876 1992 cmd.exe reg.exe PID 1992 wrote to memory of 1876 1992 cmd.exe reg.exe PID 1992 wrote to memory of 1876 1992 cmd.exe reg.exe PID 1564 wrote to memory of 1180 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1180 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1180 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1180 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1508 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1508 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1508 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1564 wrote to memory of 1508 1564 15-08-2020 - SOFT COPY_PAYMENT SLIP.exe cmd.exe PID 1508 wrote to memory of 1504 1508 cmd.exe timeout.exe PID 1508 wrote to memory of 1504 1508 cmd.exe timeout.exe PID 1508 wrote to memory of 1504 1508 cmd.exe timeout.exe PID 1508 wrote to memory of 1504 1508 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15-08-2020 - SOFT COPY_PAYMENT SLIP.exe"C:\Users\Admin\AppData\Local\Temp\15-08-2020 - SOFT COPY_PAYMENT SLIP.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\word.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\word.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\word.exe:Zone.Identifier2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FolderN\word.exe.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderN\word.exe.batFilesize
192B
MD5c3d5aa05aa173009bf0eb7dfd0379f59
SHA10c91da5a0b5338603bd8d48a7722f5055b076b4f
SHA2560156e2fc804a0b7a370953ed2e044b539b03b84c0fe478d85b4a908c1dd289ec
SHA5128e2d751990bfab7b033e0b3077e744a7cc37d357d374bb6ab1b93e26ff377c13a251df33f5927d3afe8bf7e9d65f8903a2987da3904edefee7f8f6bbcb0b0046
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
160KB
MD5692dcec5b869cd8c2a4752baf58300a7
SHA13b99f3ee911d244b0d177953b19ef520f64728c2
SHA256d9d83f0730977389fcae495d498364494f6b5948e1d8f184f7578f378215386d
SHA5129e3b69902cc51f95b0ee694148d6bac0f7b4b318b06a94c187080294102b85af831898ec99ed3a8f200a219a5cd4d4c6debc5b313148bdc754fbabc94783b0a5
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
160KB
MD5692dcec5b869cd8c2a4752baf58300a7
SHA13b99f3ee911d244b0d177953b19ef520f64728c2
SHA256d9d83f0730977389fcae495d498364494f6b5948e1d8f184f7578f378215386d
SHA5129e3b69902cc51f95b0ee694148d6bac0f7b4b318b06a94c187080294102b85af831898ec99ed3a8f200a219a5cd4d4c6debc5b313148bdc754fbabc94783b0a5
-
\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
160KB
MD5692dcec5b869cd8c2a4752baf58300a7
SHA13b99f3ee911d244b0d177953b19ef520f64728c2
SHA256d9d83f0730977389fcae495d498364494f6b5948e1d8f184f7578f378215386d
SHA5129e3b69902cc51f95b0ee694148d6bac0f7b4b318b06a94c187080294102b85af831898ec99ed3a8f200a219a5cd4d4c6debc5b313148bdc754fbabc94783b0a5
-
memory/816-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-73-0x000000000040242D-mapping.dmp
-
memory/816-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-84-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-63-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-77-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-62-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/816-72-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/956-58-0x0000000000000000-mapping.dmp
-
memory/1180-80-0x0000000000000000-mapping.dmp
-
memory/1504-83-0x0000000000000000-mapping.dmp
-
memory/1508-81-0x0000000000000000-mapping.dmp
-
memory/1564-55-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/1564-54-0x0000000000070000-0x00000000000B0000-memory.dmpFilesize
256KB
-
memory/1876-79-0x0000000000000000-mapping.dmp
-
memory/1992-78-0x0000000000000000-mapping.dmp