Analysis
-
max time kernel
109s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2023 22:58
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe
Resource
win7-20220812-en
General
-
Target
HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe
-
Size
1.3MB
-
MD5
d6bd647394753edad31e82048f050811
-
SHA1
8e55cca32928171a0e2483c2cff70ec11f950f8a
-
SHA256
35aeedd98b2c9479aeab20715ff3a3940095dda9336c2e7497105ceaa3a1ec0c
-
SHA512
6ee1c47328e177466543fe0a032cb685aaff16f162d9b42bf5abba8ca1bbc09a72533a15fbedc566b32e81378efbc30ccaef3d55162911f2092eb0735859c2c4
-
SSDEEP
24576:YfWKopnTfodNz8Zc7TWxBDZ4h0pZB5v31rIyOlIM+:28n9c+xaYp3Oy3
Malware Config
Extracted
netwire
www.secureupload.online:1929
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-wIG2G6
-
lock_executable
false
-
offline_keylogger
false
-
password
Manlike1234567!
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4944-135-0x0000000004E20000-0x0000000004E60000-memory.dmp netwire behavioral2/memory/4500-156-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/4500-157-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Drops file in Windows directory 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Windows\Tasks\HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.job notepad.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.execmd.exepid process 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe 4944 cmd.exe 4944 cmd.exe 4944 cmd.exe 4944 cmd.exe 4944 cmd.exe 4944 cmd.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
cmd.exepid process 4944 cmd.exe 4944 cmd.exe 4944 cmd.exe 4944 cmd.exe 4944 cmd.exe 4944 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exedescription pid process target process PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe PID 840 wrote to memory of 4944 840 HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Pincav.gen-35aeedd98b2c9479.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"3⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/840-133-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1292-144-0x0000000000000000-mapping.dmp
-
memory/1644-137-0x0000000000000000-mapping.dmp
-
memory/1852-146-0x0000000000000000-mapping.dmp
-
memory/2976-139-0x0000000000000000-mapping.dmp
-
memory/4124-142-0x0000000000000000-mapping.dmp
-
memory/4500-149-0x00007FF8A6210000-0x00007FF8A6405000-memory.dmpFilesize
2.0MB
-
memory/4500-148-0x0000000000000000-mapping.dmp
-
memory/4500-150-0x0000000000CA0000-0x0000000000CA9000-memory.dmpFilesize
36KB
-
memory/4500-156-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4500-157-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4944-141-0x0000000004E28000-0x0000000004E38000-memory.dmpFilesize
64KB
-
memory/4944-136-0x00007FF8A6210000-0x00007FF8A6405000-memory.dmpFilesize
2.0MB
-
memory/4944-135-0x0000000004E20000-0x0000000004E60000-memory.dmpFilesize
256KB
-
memory/4944-134-0x0000000002840000-0x0000000002848000-memory.dmpFilesize
32KB
-
memory/4944-132-0x0000000000000000-mapping.dmp
-
memory/4944-155-0x0000000004E28000-0x0000000004E38000-memory.dmpFilesize
64KB