Analysis
-
max time kernel
79s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 20:19
Static task
static1
Behavioral task
behavioral1
Sample
FeDEx TRACKING DETAILS.exe
Resource
win7v20201028
General
-
Target
FeDEx TRACKING DETAILS.exe
-
Size
316KB
-
MD5
205460f0adbfe5667223d1e5b3d9a9ee
-
SHA1
78e909ffd58734dc411d22fc72d27a833db4b969
-
SHA256
90dbd6dce0e0e7013656333f1cd8a9b7660e0e40e782a622856800c52e980d3e
-
SHA512
104ba781eb949821bad8789271feab185a2aa28ff1c6fc35cfd0bf44eee1ff7ed2412dd17d60831d55bee6af7d0731d80091f5e2edeebbc6fb3a1f622bbff775
Malware Config
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2280-3-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2280-4-0x000000000040242D-mapping.dmp netwire behavioral2/memory/3992-5-0x0000000001470000-0x00000000014A3000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FeDEx TRACKING DETAILS.exedescription pid process target process PID 3992 set thread context of 2280 3992 FeDEx TRACKING DETAILS.exe FeDEx TRACKING DETAILS.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
FeDEx TRACKING DETAILS.exepid process 3992 FeDEx TRACKING DETAILS.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
FeDEx TRACKING DETAILS.execmd.exedescription pid process target process PID 3992 wrote to memory of 2284 3992 FeDEx TRACKING DETAILS.exe cmd.exe PID 3992 wrote to memory of 2284 3992 FeDEx TRACKING DETAILS.exe cmd.exe PID 3992 wrote to memory of 2284 3992 FeDEx TRACKING DETAILS.exe cmd.exe PID 3992 wrote to memory of 2280 3992 FeDEx TRACKING DETAILS.exe FeDEx TRACKING DETAILS.exe PID 3992 wrote to memory of 2280 3992 FeDEx TRACKING DETAILS.exe FeDEx TRACKING DETAILS.exe PID 3992 wrote to memory of 2280 3992 FeDEx TRACKING DETAILS.exe FeDEx TRACKING DETAILS.exe PID 3992 wrote to memory of 2280 3992 FeDEx TRACKING DETAILS.exe FeDEx TRACKING DETAILS.exe PID 2284 wrote to memory of 2676 2284 cmd.exe schtasks.exe PID 2284 wrote to memory of 2676 2284 cmd.exe schtasks.exe PID 2284 wrote to memory of 2676 2284 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FeDEx TRACKING DETAILS.exe"C:\Users\Admin\AppData\Local\Temp\FeDEx TRACKING DETAILS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN loserty /XML "C:\Users\Admin\AppData\Local\Temp\5114842f0dd2444f9d7295083ca8bde7.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN loserty /XML "C:\Users\Admin\AppData\Local\Temp\5114842f0dd2444f9d7295083ca8bde7.xml"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\FeDEx TRACKING DETAILS.exe"C:\Users\Admin\AppData\Local\Temp\FeDEx TRACKING DETAILS.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5114842f0dd2444f9d7295083ca8bde7.xmlMD5
32351d13c843226c639330f3cb2f73af
SHA151257007014be0982c14e3ee3257b9fb24fc8f3a
SHA2568acbcfedfbde8dd837c5675967199b477b561f9e3dedf16a56eff9644b4f3159
SHA5124a38d3316b0f5e267d695097cef9771bfb680ecf5d392a041153f8a07f4ad16ff792772006e3c89e281a67e831378da734f2ab096807e0caf975e243e4b886d1
-
memory/2280-3-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2280-4-0x000000000040242D-mapping.dmp
-
memory/2284-2-0x0000000000000000-mapping.dmp
-
memory/2676-7-0x0000000000000000-mapping.dmp
-
memory/3992-5-0x0000000001470000-0x00000000014A3000-memory.dmpFilesize
204KB