Analysis
-
max time kernel
157s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 17:22
Static task
static1
Behavioral task
behavioral1
Sample
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe
Resource
win7-20220812-en
General
-
Target
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe
-
Size
235KB
-
MD5
d79664fd4738c91aa3e960ec88ced137
-
SHA1
2e0b5e5a6401d32249ba9c23dd9e3cf9c45d7aac
-
SHA256
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f
-
SHA512
e6f527893679fbacf6ecf6f91d8a600238ebfb6c6dc3b0f148e0a6f862b8f1172702c3b0edbc16bbdd8e76a76042c1453f35c249901d461e0253b9eff1b1137e
-
SSDEEP
6144:ZbEt6wTeQmG3DJJvtu8ScAVZEFFWhDNDSPB6VKYGM:qLzN37vtTKcFMDNDSPB6V3G
Malware Config
Extracted
netwire
porshe.camdvr.org:1603
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/932-62-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/932-63-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/932-64-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/932-66-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/932-68-0x000000000040242D-mapping.dmp netwire behavioral1/memory/932-67-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/932-72-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/932-76-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Drops startup file 2 IoCs
Processes:
pOwERsHeLl.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Porchemoibudut.exe pOwERsHeLl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Porchemoibudut.exe pOwERsHeLl.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exedescription pid process target process PID 1188 set thread context of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
pOwERsHeLl.exepid process 2028 pOwERsHeLl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pOwERsHeLl.exedescription pid process Token: SeDebugPrivilege 2028 pOwERsHeLl.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exedescription pid process target process PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 932 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 1188 wrote to memory of 2028 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe pOwERsHeLl.exe PID 1188 wrote to memory of 2028 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe pOwERsHeLl.exe PID 1188 wrote to memory of 2028 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe pOwERsHeLl.exe PID 1188 wrote to memory of 2028 1188 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe pOwERsHeLl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe"C:\Users\Admin\AppData\Local\Temp\0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pOwERsHeLl.exe"pOwERsHeLl.exe" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Porchemoibudut.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/932-60-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/932-72-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/932-66-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/932-68-0x000000000040242D-mapping.dmp
-
memory/932-58-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/932-62-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/932-63-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/932-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/932-76-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/932-67-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/932-57-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1188-56-0x00000000004F0000-0x0000000000504000-memory.dmpFilesize
80KB
-
memory/1188-55-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/1188-73-0x0000000005065000-0x0000000005076000-memory.dmpFilesize
68KB
-
memory/1188-54-0x00000000010C0000-0x0000000001100000-memory.dmpFilesize
256KB
-
memory/2028-70-0x0000000000000000-mapping.dmp
-
memory/2028-75-0x0000000073890000-0x0000000073E3B000-memory.dmpFilesize
5.7MB
-
memory/2028-77-0x0000000073890000-0x0000000073E3B000-memory.dmpFilesize
5.7MB