Analysis

  • max time kernel
    40s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22-08-2022 15:00

General

  • Target

    Payment_PDF.js

  • Size

    423KB

  • MD5

    371a8641026b2a7ef3006b8bb4dece0a

  • SHA1

    7bb7a599080e696f92b875f4218f22aa2db4ba16

  • SHA256

    3f15efe553460c7afa09e3464a98612d3b6107fdb1b076b985f9959b177e8214

  • SHA512

    d92047fb2c0fae92aabd73cd621302e545b024eb476e8d4a71052a2621aeda9ff98a15864acc301e6b332820c6c1345a9f67e1284e468562450e3a6ccc5e8afa

Malware Config

Signatures

  • NetWire RAT payload 7 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 2 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Payment_PDF.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\HaFZbLHqjJ.js"
      2⤵
        PID:2000
      • C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe
        "C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1684
        • C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe
          "C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"
          3⤵
          • Executes dropped EXE
          • Drops startup file
          • Loads dropped DLL
          • Adds Run key to start application
          PID:1560

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe
      Filesize

      227KB

      MD5

      fc6330d62ae89347dddf9e98d6dc2533

      SHA1

      b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

      SHA256

      72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

      SHA512

      1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

    • C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe
      Filesize

      227KB

      MD5

      fc6330d62ae89347dddf9e98d6dc2533

      SHA1

      b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

      SHA256

      72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

      SHA512

      1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

    • C:\Users\Admin\AppData\Roaming\HaFZbLHqjJ.js
      Filesize

      6KB

      MD5

      6ce191a48f5cbedf94f0857f2e1bdb0f

      SHA1

      6688758553c117f5f470b2ab24279de67320efe0

      SHA256

      3d0f0edd9ed469eab3ec7ea9c7db039765b1abe65f268706f92f9667c67ac7b4

      SHA512

      c1f7b0dc4de433688e81cdd2a1851865073d958e1ae782d1d2d0bc9cbecd3d39fb4c3e717679a4f2f042dc97d27a3a975fcb479db9392f68a2310c1348ffd657

    • C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe
      Filesize

      227KB

      MD5

      fc6330d62ae89347dddf9e98d6dc2533

      SHA1

      b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

      SHA256

      72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

      SHA512

      1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

    • C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe
      Filesize

      227KB

      MD5

      fc6330d62ae89347dddf9e98d6dc2533

      SHA1

      b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

      SHA256

      72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

      SHA512

      1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

    • \Users\Admin\AppData\Roaming\Googlee\Notepad.exe
      Filesize

      227KB

      MD5

      fc6330d62ae89347dddf9e98d6dc2533

      SHA1

      b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

      SHA256

      72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

      SHA512

      1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

    • \Users\Admin\AppData\Roaming\Googlee\Notepad.exe
      Filesize

      227KB

      MD5

      fc6330d62ae89347dddf9e98d6dc2533

      SHA1

      b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

      SHA256

      72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

      SHA512

      1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

    • \Users\Admin\AppData\Roaming\Googlee\Notepad.exe
      Filesize

      227KB

      MD5

      fc6330d62ae89347dddf9e98d6dc2533

      SHA1

      b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

      SHA256

      72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

      SHA512

      1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

    • memory/1516-54-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp
      Filesize

      8KB

    • memory/1560-63-0x0000000000000000-mapping.dmp
    • memory/1684-59-0x0000000075841000-0x0000000075843000-memory.dmp
      Filesize

      8KB

    • memory/1684-57-0x0000000000000000-mapping.dmp
    • memory/2000-55-0x0000000000000000-mapping.dmp