Analysis
-
max time kernel
127s -
max time network
126s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
29-05-2020 15:48
Static task
static1
Behavioral task
behavioral1
Sample
Fw_CONFIRMATION_OF_BALANCES-AP20.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
-
Target
Fw_CONFIRMATION_OF_BALANCES-AP20.exe
-
Size
476KB
-
MD5
8a522b7dfd76a91312ea31b4e827b4a0
-
SHA1
0754d2176df167f3e46d397f87ca3834cd89dee7
-
SHA256
77642de174198cae37f2b0ce29eb087f138800df44a79bd0e589962e9fc64e36
-
SHA512
1c82a4d893cfde8eedd9141d8ee83cccb752e9ccf1b89cbf5d3d9c9c655e1440548784eb8af82775b0930fdce137335f4bf084f63643052fa0523791bc2192b0
Malware Config
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Fw_CONFIRMATION_OF_BALANCES-AP20.exedescription pid process target process PID 376 wrote to memory of 1528 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe schtasks.exe PID 376 wrote to memory of 1528 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe schtasks.exe PID 376 wrote to memory of 1528 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe schtasks.exe PID 376 wrote to memory of 1528 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe schtasks.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe PID 376 wrote to memory of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Fw_CONFIRMATION_OF_BALANCES-AP20.exedescription pid process target process PID 376 set thread context of 1804 376 Fw_CONFIRMATION_OF_BALANCES-AP20.exe Fw_CONFIRMATION_OF_BALANCES-AP20.exe -
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1804-1-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1804-2-0x0000000000400000-0x0000000000433000-memory.dmp netwire
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fw_CONFIRMATION_OF_BALANCES-AP20.exe"C:\Users\Admin\AppData\Local\Temp\Fw_CONFIRMATION_OF_BALANCES-AP20.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TxUtzXBT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCFA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Fw_CONFIRMATION_OF_BALANCES-AP20.exe"{path}"2⤵