Analysis
-
max time kernel
185s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-06-2022 07:57
Static task
static1
Behavioral task
behavioral1
Sample
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe
-
Size
1.0MB
-
MD5
05bb8a97d369164689119bbe0b3327fc
-
SHA1
be35eb99fb18487aec83a2f5dc954a691c9b4e0f
-
SHA256
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1
-
SHA512
601083c187904f7723204d071070ff297549a712c6afb9b21e763f372b81d29b18ea60ba7d27357f6f0792bbbe47511bb9f7fddc667fd5b6300ae6d200c57702
Malware Config
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2292-131-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/2292-133-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/2292-134-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral2/memory/2292-135-0x0000000000400000-0x0000000000420000-memory.dmp netwire -
Drops startup file 1 IoCs
Processes:
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deQNDWfWFq.eu.url 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe -
Drops file in System32 directory 3 IoCs
Processes:
dllhost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\.Identifier dllhost.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe dllhost.exe File created C:\Windows\SysWOW64\.Identifier dllhost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exedescription pid process target process PID 4560 set thread context of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exepid process 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exedescription pid process target process PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe PID 4560 wrote to memory of 2292 4560 26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe"C:\Users\Admin\AppData\Local\Temp\26989aa946a3c511b62b809bb98c2c7cf947ca5bfad628873ab3f6b94297b7d1.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2292-130-0x0000000000000000-mapping.dmp
-
memory/2292-131-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2292-133-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2292-134-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2292-135-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB