Analysis
- max time kernel
149s - max time network
140s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:09
Static task
static1
Behavioral task
behavioral1
Sample
kxv.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target kxv.exe
- Size 1.2MB
- Sample201109-9m1pc4ekqs
- SHA256 2bd1dea449db5de4c51466758cb179c40108bf6f4591648dcae7e3692fcd7002
- MD5 7ffbb837e7694cac880f7fb594df3e83
- SHA1 8c799690c0ff67ffbbbcb931c7d3c6c7bc33a707
- SHA512 c04407d8fcbf09aec642b15f1d91cbd7988d6a0015df16c06eb188a79c9cd053ba29ea6cb234ae6fa9a125420afc92a417ea5ee57a2bd03b646dd3c9b4ae5e80
- MD5 SHA1 SHA512
Malware Config
Signatures
- NetWire RAT payload 2 IoCs
resource yara_rule behavioral2/memory/3456-0-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/3456-1-0x000000000040242D-mapping.dmp netwire - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vsjitdebugger.url kxv.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1812 set thread context of 3456 1812 kxv.exe 75 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1812 kxv.exe 1812 kxv.exe 1812 kxv.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1812 wrote to memory of 3456 1812 kxv.exe 75 PID 1812 wrote to memory of 3456 1812 kxv.exe 75 PID 1812 wrote to memory of 3456 1812 kxv.exe 75 PID 1812 wrote to memory of 3456 1812 kxv.exe 75 PID 1812 wrote to memory of 3456 1812 kxv.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\kxv.exe"C:\Users\Admin\AppData\Local\Temp\kxv.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\kxv.exe"C:\Users\Admin\AppData\Local\Temp\kxv.exe"2⤵PID:3456
-