Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22/08/2021, 18:44
Static task
static1
Behavioral task
behavioral1
Sample
Trustwallet.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Trustwallet.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
Trustwallet.exe
-
Size
11.9MB
-
MD5
96a57994dac844201da03003ee2183ae
-
SHA1
e7cd1448b9b33c928b25451a9f72de71b2dbc7bf
-
SHA256
9353cf6347377bf1194349bff4001485fac99a5cd3ee03781e81c157452dae68
-
SHA512
5f82aa92a1f15287884bc7fcb26f7b0bcf2db0444417c678e613c46f0c9da0833845ca1fefc10ea35ec58ad6d7c9c627081bdf94915e41f136b6abdf3e6cf6de
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Downloads\README.txt
Ransom Note
Locked Out? Ouch!
we accept Bitcoins & all cryptocurrency
[email protected]
be rest assured,you get your files and your system back after payment.
Emails
Signatures
-
DemonWare
Ransomware first seen in mid-2020.
-
Loads dropped DLL 54 IoCs
pid Process 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe 2044 Trustwallet.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1096 wrote to memory of 2044 1096 Trustwallet.exe 26 PID 1096 wrote to memory of 2044 1096 Trustwallet.exe 26 PID 1096 wrote to memory of 2044 1096 Trustwallet.exe 26 PID 1096 wrote to memory of 2044 1096 Trustwallet.exe 26