Analysis
-
max time kernel
147s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-01-2023 22:58
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe
Resource
win7-20220812-en
General
-
Target
HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe
-
Size
1.3MB
-
MD5
d6bd647394753edad31e82048f050811
-
SHA1
8e55cca32928171a0e2483c2cff70ec11f950f8a
-
SHA256
35aeedd98b2c9479aeab20715ff3a3940095dda9336c2e7497105ceaa3a1ec0c
-
SHA512
6ee1c47328e177466543fe0a032cb685aaff16f162d9b42bf5abba8ca1bbc09a72533a15fbedc566b32e81378efbc30ccaef3d55162911f2092eb0735859c2c4
-
SSDEEP
24576:YfWKopnTfodNz8Zc7TWxBDZ4h0pZB5v31rIyOlIM+:28n9c+xaYp3Oy3
Malware Config
Extracted
netwire
www.secureupload.online:1929
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-MAm4sa
-
lock_executable
false
-
offline_keylogger
false
-
password
Manlike1234567!
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/964-57-0x0000000004830000-0x0000000004870000-memory.dmp netwire behavioral1/memory/1868-69-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1868-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Blocklisted process makes network request 1 IoCs
Processes:
cmd.exeflow pid process 7 1868 cmd.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.job cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.execmd.exepid process 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe 964 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
cmd.exepid process 964 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.execmd.exedescription pid process target process PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 1956 wrote to memory of 964 1956 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe PID 964 wrote to memory of 1868 964 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-54-0x0000000000000000-mapping.dmp
-
memory/964-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/964-57-0x0000000004830000-0x0000000004870000-memory.dmpFilesize
256KB
-
memory/964-58-0x00000000776A0000-0x0000000077849000-memory.dmpFilesize
1.7MB
-
memory/964-59-0x00000000001A0000-0x00000000001A8000-memory.dmpFilesize
32KB
-
memory/964-60-0x0000000004838000-0x0000000004848000-memory.dmpFilesize
64KB
-
memory/1868-61-0x0000000000000000-mapping.dmp
-
memory/1868-63-0x0000000000090000-0x0000000000099000-memory.dmpFilesize
36KB
-
memory/1868-64-0x00000000776A0000-0x0000000077849000-memory.dmpFilesize
1.7MB
-
memory/1868-69-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1868-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1956-56-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB