Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
24-06-2020 15:06
Static task
static1
Behavioral task
behavioral1
Sample
23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe
-
Size
1.2MB
-
MD5
c78124cbf501154c3322e594cb076e17
-
SHA1
dd8b28a78383e3435487178509a18a21d1385d61
-
SHA256
23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827
-
SHA512
db3e711f00bf77ee7147f16f5426cf7594bddb2f70731cc97b8f6e28a4b4ba6eae238f51b3c9bcb91338e24e01f12df5801487db98587b961a221f23b0174a1f
Malware Config
Signatures
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exepid process 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exedescription pid process target process PID 2556 wrote to memory of 504 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe PID 2556 wrote to memory of 504 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe PID 2556 wrote to memory of 504 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe PID 2556 wrote to memory of 504 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe PID 2556 wrote to memory of 504 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exedescription pid process target process PID 2556 set thread context of 504 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe -
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/504-0-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Drops startup file 1 IoCs
Processes:
23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\efsui.url 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exepid process 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe 2556 23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe"C:\Users\Admin\AppData\Local\Temp\23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe"1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Drops startup file
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe"C:\Users\Admin\AppData\Local\Temp\23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827.exe"2⤵