Analysis
-
max time kernel
153s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 14:33
Static task
static1
Behavioral task
behavioral1
Sample
SCANDA_Statement_of_Account_July_2020.exe
Resource
win7-20220414-en
General
-
Target
SCANDA_Statement_of_Account_July_2020.exe
-
Size
486KB
-
MD5
32c10b0b4bb8a7e70cf58c573a05f16a
-
SHA1
a22e8814f215f2564d6c476506d7f76eb78fe80e
-
SHA256
146856560590ec6f2434f34fe94b4dd5de0d7ed700cdaccc15663db1fbc8c4aa
-
SHA512
717ea71453999846b87dfe952b9d6cc64617a69909e07de9934668e48f320b7be52ec370917adf520a36de5a0441091e73565c3083e58f251e8b8af5776b7042
Malware Config
Signatures
-
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1144-65-0x0000000000640000-0x0000000000673000-memory.dmp netwire -
Processes:
resource yara_rule behavioral1/memory/1668-55-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral1/memory/1668-61-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral1/memory/1408-62-0x0000000000400000-0x00000000004EF000-memory.dmp upx behavioral1/memory/1408-64-0x0000000000400000-0x00000000004EF000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SCANDA_Statement_of_Account_July_2020.exedescription pid process target process PID 1668 set thread context of 1144 1668 SCANDA_Statement_of_Account_July_2020.exe SCANDA_Statement_of_Account_July_2020.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SCANDA_Statement_of_Account_July_2020.exeSCANDA_Statement_of_Account_July_2020.exeSCANDA_Statement_of_Account_July_2020.exepid process 1668 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1144 SCANDA_Statement_of_Account_July_2020.exe 1144 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe 1408 SCANDA_Statement_of_Account_July_2020.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
SCANDA_Statement_of_Account_July_2020.exepid process 1668 SCANDA_Statement_of_Account_July_2020.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 1764 AcroRd32.exe 1764 AcroRd32.exe 1764 AcroRd32.exe 1764 AcroRd32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SCANDA_Statement_of_Account_July_2020.exedescription pid process target process PID 1668 wrote to memory of 1764 1668 SCANDA_Statement_of_Account_July_2020.exe AcroRd32.exe PID 1668 wrote to memory of 1764 1668 SCANDA_Statement_of_Account_July_2020.exe AcroRd32.exe PID 1668 wrote to memory of 1764 1668 SCANDA_Statement_of_Account_July_2020.exe AcroRd32.exe PID 1668 wrote to memory of 1764 1668 SCANDA_Statement_of_Account_July_2020.exe AcroRd32.exe PID 1668 wrote to memory of 1144 1668 SCANDA_Statement_of_Account_July_2020.exe SCANDA_Statement_of_Account_July_2020.exe PID 1668 wrote to memory of 1144 1668 SCANDA_Statement_of_Account_July_2020.exe SCANDA_Statement_of_Account_July_2020.exe PID 1668 wrote to memory of 1144 1668 SCANDA_Statement_of_Account_July_2020.exe SCANDA_Statement_of_Account_July_2020.exe PID 1668 wrote to memory of 1144 1668 SCANDA_Statement_of_Account_July_2020.exe SCANDA_Statement_of_Account_July_2020.exe PID 1668 wrote to memory of 1408 1668 SCANDA_Statement_of_Account_July_2020.exe SCANDA_Statement_of_Account_July_2020.exe PID 1668 wrote to memory of 1408 1668 SCANDA_Statement_of_Account_July_2020.exe SCANDA_Statement_of_Account_July_2020.exe PID 1668 wrote to memory of 1408 1668 SCANDA_Statement_of_Account_July_2020.exe SCANDA_Statement_of_Account_July_2020.exe PID 1668 wrote to memory of 1408 1668 SCANDA_Statement_of_Account_July_2020.exe SCANDA_Statement_of_Account_July_2020.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SCANDA_Statement_of_Account_July_2020.exe"C:\Users\Admin\AppData\Local\Temp\SCANDA_Statement_of_Account_July_2020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Order.pdf"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\SCANDA_Statement_of_Account_July_2020.exe"C:\Users\Admin\AppData\Local\Temp\SCANDA_Statement_of_Account_July_2020.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\SCANDA_Statement_of_Account_July_2020.exe"C:\Users\Admin\AppData\Local\Temp\SCANDA_Statement_of_Account_July_2020.exe" 2 1144 70780302⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Order.pdfFilesize
38KB
MD564c51e428b3aae202fe3b1f250783e38
SHA19c37ca4019a5ed8b6368a2c8a9319cac7541d86d
SHA2560f92458dfe74bca8a5fb6e5db0d52d0227e9126a846f311a6b3b7ba16d8021d4
SHA512dab4a6fe5331d757311737dffa73ebca4a91c6fa53b50e50c1d39f839039ab46b8e5fd029259394292c30ec85a88726de31fb2fa99d87e9a7350e9f82f4985dd
-
memory/1144-58-0x0000000000600087-mapping.dmp
-
memory/1144-65-0x0000000000640000-0x0000000000673000-memory.dmpFilesize
204KB
-
memory/1408-59-0x0000000000000000-mapping.dmp
-
memory/1408-62-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1408-64-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1668-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB
-
memory/1668-55-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1668-61-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1764-56-0x0000000000000000-mapping.dmp