Analysis
-
max time kernel
147s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-06-2022 07:57
Static task
static1
Behavioral task
behavioral1
Sample
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe
-
Size
1.0MB
-
MD5
05bb8a97d369164689119bbe0b3327fc
-
SHA1
be35eb99fb18487aec83a2f5dc954a691c9b4e0f
-
SHA256
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1
-
SHA512
601083c187904f7723204d071070ff297549a712c6afb9b21e763f372b81d29b18ea60ba7d27357f6f0792bbbe47511bb9f7fddc667fd5b6300ae6d200c57702
Malware Config
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1928-60-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral1/memory/1928-63-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/1928-62-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral1/memory/1928-66-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral1/memory/1928-67-0x0000000000400000-0x0000000000420000-memory.dmp netwire -
Drops startup file 1 IoCs
Processes:
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deQNDWfWFq.eu.url 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe -
Drops file in System32 directory 3 IoCs
Processes:
dllhost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\dllhost.exe dllhost.exe File created C:\Windows\SysWOW64\.Identifier dllhost.exe File opened for modification C:\Windows\SysWOW64\.Identifier dllhost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exedescription pid process target process PID 760 set thread context of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exepid process 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exedescription pid process target process PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 760 wrote to memory of 1928 760 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe"C:\Users\Admin\AppData\Local\Temp\26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-54-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1928-55-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1928-56-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1928-58-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1928-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1928-63-0x00000000004021DA-mapping.dmp
-
memory/1928-62-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1928-66-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1928-67-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB