Analysis
-
max time kernel
106s -
max time network
185s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
09-02-2023 08:06
Static task
static1
Behavioral task
behavioral1
Sample
Proof of Payment.exe
Resource
win7-20221111-en
General
-
Target
Proof of Payment.exe
-
Size
674KB
-
MD5
8359e25b8dd8545649e05ab3886329a0
-
SHA1
2a2ce1a9ac8b3670838f0c1880a768d4f862cbab
-
SHA256
9d2977e8e247515a58c1a05c3111a05ed3832c9f01e5df39c1ff5717531f421d
-
SHA512
d0bc508adb175738ad65a9a6cea08071ccc7837a6befea48275d0e2ba65785c2444ea2c26e98570f82b35a555156136da2409bfcdc7c954347ebb078cc9c29fd
-
SSDEEP
12288:v/o8ZROaaCOUQPM0kMDMhOvsWRUj9XK2KHmFZcn5Efr5QQlQX:v1Oa3Ot+MDMhnWRUjBdW5YiQlQX
Malware Config
Extracted
netwire
194.5.98.101:3362
194.5.98.101:3365
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Levels2023
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1548-70-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1548-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1548-72-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1548-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1548-76-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1548-75-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1548-79-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1548-80-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proof of Payment.exedescription pid process target process PID 1116 set thread context of 1548 1116 Proof of Payment.exe Proof of Payment.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 580 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 580 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Proof of Payment.exedescription pid process target process PID 1116 wrote to memory of 580 1116 Proof of Payment.exe powershell.exe PID 1116 wrote to memory of 580 1116 Proof of Payment.exe powershell.exe PID 1116 wrote to memory of 580 1116 Proof of Payment.exe powershell.exe PID 1116 wrote to memory of 580 1116 Proof of Payment.exe powershell.exe PID 1116 wrote to memory of 320 1116 Proof of Payment.exe schtasks.exe PID 1116 wrote to memory of 320 1116 Proof of Payment.exe schtasks.exe PID 1116 wrote to memory of 320 1116 Proof of Payment.exe schtasks.exe PID 1116 wrote to memory of 320 1116 Proof of Payment.exe schtasks.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe PID 1116 wrote to memory of 1548 1116 Proof of Payment.exe Proof of Payment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wGnSpcKZJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wGnSpcKZJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp952F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp952F.tmpFilesize
1KB
MD51a59f00a0d9ec0f9b70f6bd07d79ea28
SHA19eef2c9791667d0d9d76590a4078e77ee70cf4f8
SHA2565e3d514f032ce98086a346b239cf4f70be1d38eec2fe9cfa53af557b3063d27f
SHA5125ac83ad7cecac417ea4b1dae80437b15d978d917f78689f1e8963c871519933bf4c3412fdf8e6cf35db77c5d2e7b7c70697ae37b40407d11c6e4e856d0a233da
-
memory/320-60-0x0000000000000000-mapping.dmp
-
memory/580-81-0x000000006DEE0000-0x000000006E48B000-memory.dmpFilesize
5.7MB
-
memory/580-59-0x0000000000000000-mapping.dmp
-
memory/580-63-0x000000006DEE0000-0x000000006E48B000-memory.dmpFilesize
5.7MB
-
memory/1116-55-0x0000000076381000-0x0000000076383000-memory.dmpFilesize
8KB
-
memory/1116-56-0x0000000000910000-0x0000000000924000-memory.dmpFilesize
80KB
-
memory/1116-57-0x00000000009C0000-0x00000000009CC000-memory.dmpFilesize
48KB
-
memory/1116-58-0x0000000005D10000-0x0000000005D9A000-memory.dmpFilesize
552KB
-
memory/1116-64-0x0000000004740000-0x0000000004770000-memory.dmpFilesize
192KB
-
memory/1116-54-0x0000000000A30000-0x0000000000ADE000-memory.dmpFilesize
696KB
-
memory/1548-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1548-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1548-70-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1548-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1548-72-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1548-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1548-76-0x000000000040242D-mapping.dmp
-
memory/1548-75-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1548-79-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1548-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1548-66-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB