Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-02-2023 08:06
Static task
static1
Behavioral task
behavioral1
Sample
Proof of Payment.exe
Resource
win7-20221111-en
General
-
Target
Proof of Payment.exe
-
Size
674KB
-
MD5
8359e25b8dd8545649e05ab3886329a0
-
SHA1
2a2ce1a9ac8b3670838f0c1880a768d4f862cbab
-
SHA256
9d2977e8e247515a58c1a05c3111a05ed3832c9f01e5df39c1ff5717531f421d
-
SHA512
d0bc508adb175738ad65a9a6cea08071ccc7837a6befea48275d0e2ba65785c2444ea2c26e98570f82b35a555156136da2409bfcdc7c954347ebb078cc9c29fd
-
SSDEEP
12288:v/o8ZROaaCOUQPM0kMDMhOvsWRUj9XK2KHmFZcn5Efr5QQlQX:v1Oa3Ot+MDMhnWRUjBdW5YiQlQX
Malware Config
Extracted
netwire
194.5.98.101:3362
194.5.98.101:3365
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Levels2023
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1444-144-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1444-146-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/1444-150-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Proof of Payment.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Proof of Payment.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Proof of Payment.exedescription pid process target process PID 4364 set thread context of 1444 4364 Proof of Payment.exe Proof of Payment.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Proof of Payment.exepowershell.exepid process 4364 Proof of Payment.exe 4364 Proof of Payment.exe 960 powershell.exe 960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Proof of Payment.exepowershell.exedescription pid process Token: SeDebugPrivilege 4364 Proof of Payment.exe Token: SeDebugPrivilege 960 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Proof of Payment.exedescription pid process target process PID 4364 wrote to memory of 960 4364 Proof of Payment.exe powershell.exe PID 4364 wrote to memory of 960 4364 Proof of Payment.exe powershell.exe PID 4364 wrote to memory of 960 4364 Proof of Payment.exe powershell.exe PID 4364 wrote to memory of 4084 4364 Proof of Payment.exe schtasks.exe PID 4364 wrote to memory of 4084 4364 Proof of Payment.exe schtasks.exe PID 4364 wrote to memory of 4084 4364 Proof of Payment.exe schtasks.exe PID 4364 wrote to memory of 2996 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 2996 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 2996 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe PID 4364 wrote to memory of 1444 4364 Proof of Payment.exe Proof of Payment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wGnSpcKZJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wGnSpcKZJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5AC2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"C:\Users\Admin\AppData\Local\Temp\Proof of Payment.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5AC2.tmpFilesize
1KB
MD5432e824057fade93de3cf4666c466d2e
SHA12adc9c00556aa9be75765b50c62ae20b2d6211eb
SHA2562de6d5cccd0517741c13d468ce6cf1d99ccf5886566a17a7ded719adbe61d2a6
SHA51200335a005d52ff40ab7d121519d40c5bfafc8e0e1d86ccc32ca8910fc78588724142c0a482af84917d2aaa21ae15cd34c1a96d1d9b0f5f5c25cfa0002127d64c
-
memory/960-147-0x0000000005410000-0x0000000005432000-memory.dmpFilesize
136KB
-
memory/960-153-0x0000000070680000-0x00000000706CC000-memory.dmpFilesize
304KB
-
memory/960-160-0x0000000007A20000-0x0000000007A3A000-memory.dmpFilesize
104KB
-
memory/960-158-0x0000000007960000-0x00000000079F6000-memory.dmpFilesize
600KB
-
memory/960-137-0x0000000000000000-mapping.dmp
-
memory/960-157-0x0000000007760000-0x000000000776A000-memory.dmpFilesize
40KB
-
memory/960-139-0x0000000004E50000-0x0000000004E86000-memory.dmpFilesize
216KB
-
memory/960-156-0x00000000076F0000-0x000000000770A000-memory.dmpFilesize
104KB
-
memory/960-141-0x00000000054C0000-0x0000000005AE8000-memory.dmpFilesize
6.2MB
-
memory/960-155-0x0000000007D50000-0x00000000083CA000-memory.dmpFilesize
6.5MB
-
memory/960-154-0x0000000006910000-0x000000000692E000-memory.dmpFilesize
120KB
-
memory/960-148-0x0000000005CE0000-0x0000000005D46000-memory.dmpFilesize
408KB
-
memory/960-161-0x0000000007A10000-0x0000000007A18000-memory.dmpFilesize
32KB
-
memory/960-159-0x0000000007920000-0x000000000792E000-memory.dmpFilesize
56KB
-
memory/960-152-0x0000000006930000-0x0000000006962000-memory.dmpFilesize
200KB
-
memory/960-149-0x0000000005DC0000-0x0000000005E26000-memory.dmpFilesize
408KB
-
memory/960-151-0x00000000063D0000-0x00000000063EE000-memory.dmpFilesize
120KB
-
memory/1444-150-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1444-144-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1444-143-0x0000000000000000-mapping.dmp
-
memory/1444-146-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2996-142-0x0000000000000000-mapping.dmp
-
memory/4084-138-0x0000000000000000-mapping.dmp
-
memory/4364-134-0x0000000004C30000-0x0000000004CC2000-memory.dmpFilesize
584KB
-
memory/4364-133-0x00000000052C0000-0x0000000005864000-memory.dmpFilesize
5.6MB
-
memory/4364-136-0x00000000088E0000-0x000000000897C000-memory.dmpFilesize
624KB
-
memory/4364-132-0x00000000001C0000-0x000000000026E000-memory.dmpFilesize
696KB
-
memory/4364-135-0x0000000004BF0000-0x0000000004BFA000-memory.dmpFilesize
40KB