Analysis
-
max time kernel
147s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 17:22
Static task
static1
Behavioral task
behavioral1
Sample
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe
Resource
win7-20220812-en
General
-
Target
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe
-
Size
235KB
-
MD5
d79664fd4738c91aa3e960ec88ced137
-
SHA1
2e0b5e5a6401d32249ba9c23dd9e3cf9c45d7aac
-
SHA256
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f
-
SHA512
e6f527893679fbacf6ecf6f91d8a600238ebfb6c6dc3b0f148e0a6f862b8f1172702c3b0edbc16bbdd8e76a76042c1453f35c249901d461e0253b9eff1b1137e
-
SSDEEP
6144:ZbEt6wTeQmG3DJJvtu8ScAVZEFFWhDNDSPB6VKYGM:qLzN37vtTKcFMDNDSPB6V3G
Malware Config
Extracted
netwire
porshe.camdvr.org:1603
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2188-139-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2188-141-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2188-148-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Drops startup file 2 IoCs
Processes:
pOwERsHeLl.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Porchemoibudut.exe pOwERsHeLl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Porchemoibudut.exe pOwERsHeLl.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exedescription pid process target process PID 4768 set thread context of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pOwERsHeLl.exepid process 2828 pOwERsHeLl.exe 2828 pOwERsHeLl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pOwERsHeLl.exedescription pid process Token: SeDebugPrivilege 2828 pOwERsHeLl.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exedescription pid process target process PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2188 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe InstallUtil.exe PID 4768 wrote to memory of 2828 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe pOwERsHeLl.exe PID 4768 wrote to memory of 2828 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe pOwERsHeLl.exe PID 4768 wrote to memory of 2828 4768 0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe pOwERsHeLl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe"C:\Users\Admin\AppData\Local\Temp\0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pOwERsHeLl.exe"pOwERsHeLl.exe" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\0ea7636fde41771f7c286e7f9bd2ded83c5f5f32d9990ada547051fa33e8748f.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Porchemoibudut.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2188-138-0x0000000000000000-mapping.dmp
-
memory/2188-148-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2188-141-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2188-139-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2828-143-0x0000000002D00000-0x0000000002D36000-memory.dmpFilesize
216KB
-
memory/2828-147-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/2828-152-0x0000000006B50000-0x0000000006B72000-memory.dmpFilesize
136KB
-
memory/2828-151-0x0000000006B00000-0x0000000006B1A000-memory.dmpFilesize
104KB
-
memory/2828-150-0x0000000006B90000-0x0000000006C26000-memory.dmpFilesize
600KB
-
memory/2828-142-0x0000000000000000-mapping.dmp
-
memory/2828-149-0x0000000006630000-0x000000000664E000-memory.dmpFilesize
120KB
-
memory/2828-144-0x00000000058E0000-0x0000000005F08000-memory.dmpFilesize
6.2MB
-
memory/2828-145-0x0000000005690000-0x00000000056B2000-memory.dmpFilesize
136KB
-
memory/2828-146-0x0000000005F80000-0x0000000005FE6000-memory.dmpFilesize
408KB
-
memory/4768-137-0x00000000058E0000-0x0000000005936000-memory.dmpFilesize
344KB
-
memory/4768-133-0x00000000055B0000-0x000000000564C000-memory.dmpFilesize
624KB
-
memory/4768-132-0x0000000000C20000-0x0000000000C60000-memory.dmpFilesize
256KB
-
memory/4768-134-0x0000000005C00000-0x00000000061A4000-memory.dmpFilesize
5.6MB
-
memory/4768-135-0x00000000056F0000-0x0000000005782000-memory.dmpFilesize
584KB
-
memory/4768-136-0x00000000056B0000-0x00000000056BA000-memory.dmpFilesize
40KB