Analysis
-
max time kernel
155s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 09:55
Static task
static1
Behavioral task
behavioral1
Sample
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe
-
Size
159KB
-
MD5
389eb42409ce5da14af2311a26a1e8cf
-
SHA1
0e2305cc75cf934521243b162b1b7f260407e0db
-
SHA256
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9
-
SHA512
45a944f6d7974e406e119e5a73b956821ccf96fe4b999cf8a351105215d27491fcd1ec6489be065f8b04f69698b758ef1302dc62699613962cd5863b096ab382
Malware Config
Signatures
-
NetWire RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4212-132-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Drops startup file 1 IoCs
Processes:
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cxvgdff.vbs a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exedescription pid process target process PID 1736 set thread context of 4212 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exepid process 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exepid process 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exedescription pid process target process PID 1736 wrote to memory of 4212 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe svchost.exe PID 1736 wrote to memory of 4212 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe svchost.exe PID 1736 wrote to memory of 4212 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe svchost.exe PID 1736 wrote to memory of 4212 1736 a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe"C:\Users\Admin\AppData\Local\Temp\a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a40124b437f62aba90af59ec30355a9ab7b1dbadbf1c18e12394d053c3b7c7b9.exe"2⤵