Analysis

  • max time kernel
    137s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 18:26

General

  • Target

    Proof of payment.exe

  • Size

    1.0MB

  • MD5

    328549191a15865db4e088aa1375a7b2

  • SHA1

    5b2128274c3c069c90fe14b13c95ee1339873048

  • SHA256

    ff0ebb75a316c61d851a3edfb2ec49a5c05a2054032dbb9f175b7990fd8959dc

  • SHA512

    b646c21e687e0efa75913d21b3403f9ff0945d91158a9dbd318685d2eecacbc4f79f24f2cf3420045c1dee6161b71d084703277e8a4e2df79fa1177b7b42d205

Malware Config

Signatures

  • NetWire RAT payload 4 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Proof of payment.exe
    "C:\Users\Admin\AppData\Local\Temp\Proof of payment.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Users\Admin\02912207\sghgbomj.pif
      "C:\Users\Admin\02912207\sghgbomj.pif" vasck.bcd
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:64
      • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        3⤵
        • Executes dropped EXE
        PID:4476

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\02912207\nbcpasvxvo.dll
    Filesize

    318KB

    MD5

    8233b25d769f41d9fda1facf016002f1

    SHA1

    2a559587d53cba17648fe81fdbaac17f35aa249b

    SHA256

    7042cb233ee355aa3df68ba8de4b5705b3e8ed0df7074d3eb2506b8e49cd5360

    SHA512

    9d5f95695d0fad97fa792101c8f30a497cd74f533d5610256312ca8ff62f10389483b9fa461216efac1760f60eeeaaa59e295390962c7d0acdad4c851d68bdae

  • C:\Users\Admin\02912207\sghgbomj.pif
    Filesize

    910KB

    MD5

    503fbeaa015418e1a57880f8a0306d43

    SHA1

    bd05b27424688e8d8aad7f99ea0d6aa1efbbe8a0

    SHA256

    ad6a04f8a27507d42f7aa6a668d4892352142be6701ea83b2e0d49d222b586f9

    SHA512

    17367cdcf5db8d9ca23d8b20a02bcc9e4880a2d62cf1be13eed2b7ccb8848acd50c194f2b864e655dde9ff1e9e9e14412b04d40ce4749bd2e68fdaba9bd29900

  • C:\Users\Admin\02912207\sghgbomj.pif
    Filesize

    910KB

    MD5

    503fbeaa015418e1a57880f8a0306d43

    SHA1

    bd05b27424688e8d8aad7f99ea0d6aa1efbbe8a0

    SHA256

    ad6a04f8a27507d42f7aa6a668d4892352142be6701ea83b2e0d49d222b586f9

    SHA512

    17367cdcf5db8d9ca23d8b20a02bcc9e4880a2d62cf1be13eed2b7ccb8848acd50c194f2b864e655dde9ff1e9e9e14412b04d40ce4749bd2e68fdaba9bd29900

  • C:\Users\Admin\02912207\vasck.bcd
    Filesize

    165.7MB

    MD5

    b6460ffa0134f8e2afe01ffdff40234b

    SHA1

    142c559f4aa305bfae13f15a7b328532fb6d08dc

    SHA256

    b6c3a92a0493fa3edda22081daeb442efb6eaffc830b958c76959f8ed6666363

    SHA512

    9201d911bcdbd43e3149192e09a604202fbb1956f5fc410d3ac2016490209b0a3e6c59085c6e6015465ccd1f72dc4b71ee001e7e4dc46227aee12e19d3f51ed2

  • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    Filesize

    44KB

    MD5

    9d352bc46709f0cb5ec974633a0c3c94

    SHA1

    1969771b2f022f9a86d77ac4d4d239becdf08d07

    SHA256

    2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

    SHA512

    13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

  • memory/64-130-0x0000000000000000-mapping.dmp
  • memory/4476-135-0x0000000000900000-0x0000000000E66000-memory.dmp
    Filesize

    5.4MB

  • memory/4476-136-0x0000000000902BCB-mapping.dmp
  • memory/4476-139-0x0000000000900000-0x0000000000E66000-memory.dmp
    Filesize

    5.4MB

  • memory/4476-140-0x0000000000900000-0x0000000000E66000-memory.dmp
    Filesize

    5.4MB