Analysis
-
max time kernel
82s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-11-2022 11:21
Static task
static1
Behavioral task
behavioral1
Sample
Payment Slip.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Payment Slip.exe
Resource
win10v2004-20220812-en
General
-
Target
Payment Slip.exe
-
Size
665KB
-
MD5
34dd3c65abeca163b3347a7623d5dfa9
-
SHA1
439b3d605cdbfbd34d9d9f66c9c4851dfd41fc25
-
SHA256
8f24221caef706d4502572968c0cf1317e632ebcb64157a5a1dafbdde7fc642c
-
SHA512
769e85ac91e207fdb5118b8da6b4d62152e3f18b59dbb3d8136f44bfe38200f4dea27d0c44183b2583cfdf22622cca81831fd201ec2cc200881fc0cc17179d47
-
SSDEEP
12288:1T6whuJ/Qvhzps7225LN2/4c2J8skPiTMLEF00WlCJm19H2n7T9jFPuUTi8DPN/P:nuJIs7229N2/O8sMBwF00WlC09H0T9jd
Malware Config
Extracted
netwire
zonedx.ddns.net:3360
85.209.134.105:3360
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password9090
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
-
NetWire RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1732-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1732-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1732-73-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1732-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1732-75-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1732-78-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1732-79-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1732-82-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Payment Slip.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Payment Slip.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Payment Slip.exe" Payment Slip.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment Slip.exedescription pid process target process PID 544 set thread context of 1732 544 Payment Slip.exe Payment Slip.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 976 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 976 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Payment Slip.exedescription pid process target process PID 544 wrote to memory of 976 544 Payment Slip.exe powershell.exe PID 544 wrote to memory of 976 544 Payment Slip.exe powershell.exe PID 544 wrote to memory of 976 544 Payment Slip.exe powershell.exe PID 544 wrote to memory of 976 544 Payment Slip.exe powershell.exe PID 544 wrote to memory of 1308 544 Payment Slip.exe schtasks.exe PID 544 wrote to memory of 1308 544 Payment Slip.exe schtasks.exe PID 544 wrote to memory of 1308 544 Payment Slip.exe schtasks.exe PID 544 wrote to memory of 1308 544 Payment Slip.exe schtasks.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe PID 544 wrote to memory of 1732 544 Payment Slip.exe Payment Slip.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hLjugFXbb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hLjugFXbb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59E4.tmp"2⤵
- Creates scheduled task(s)
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"2⤵
- Adds Run key to start application
PID:1732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp59E4.tmpFilesize
1KB
MD5f77dd3dab7c16a35044381fc378b8808
SHA1b3ea40d72c7fffb64db8caac2d8c6da0b10c2552
SHA2563c06523e88447566f4506a81384ea8f664e3987c3aaf3dbb51f26d5b049d7192
SHA512b820d7137b3e6716b18e3967db7c76df87b40b9e9e2e901ccde5826310563bf4cd47d0d062d7b94ca4423b8bded3b260164ee3d21c69062e626c7229e696c163
-
memory/544-55-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/544-56-0x0000000000C10000-0x0000000000C2A000-memory.dmpFilesize
104KB
-
memory/544-57-0x0000000000320000-0x000000000032C000-memory.dmpFilesize
48KB
-
memory/544-58-0x0000000007600000-0x0000000007668000-memory.dmpFilesize
416KB
-
memory/544-63-0x0000000007270000-0x000000000729E000-memory.dmpFilesize
184KB
-
memory/544-54-0x0000000000E30000-0x0000000000EDC000-memory.dmpFilesize
688KB
-
memory/976-80-0x00000000744E0000-0x0000000074A8B000-memory.dmpFilesize
5.7MB
-
memory/976-59-0x0000000000000000-mapping.dmp
-
memory/976-81-0x00000000744E0000-0x0000000074A8B000-memory.dmpFilesize
5.7MB
-
memory/1308-60-0x0000000000000000-mapping.dmp
-
memory/1732-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-73-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-75-0x000000000040242D-mapping.dmp
-
memory/1732-78-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-79-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-82-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB