netwire | 18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214

General

Target

18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
Size

817KB
MD5

d73b8c3a4405846fd0ba8c384a7113a1
SHA1

0751fb4a0ac6671c71d7b48caf605e77b1424c3d
SHA256

18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214
SHA512

239e0578ff629073b26a76bc46e427c1dce63f811d7baab50af73fcda91ed9b70191b056bdaf3fc2999485218a8e9bc7071956d2b5d634004e0cb8120321b727
SSDEEP

24576:HRmJkcoQricOIQxiZY1iaBcien5VcrEjFk6d:sJZoQrbTFZY1iaBcBXc0P

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\winmgr89.exe,explorer.exe"	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe

NetWire RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1956-66-0x0000000000400000-0x0000000000417000-memory.dmp	netwire
behavioral1/memory/1956-68-0x0000000000400000-0x0000000000417000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Executes dropped EXE 2 IoCs

Processes:

winmgr89.exewinmgr89.exe

pid process

860 winmgr89.exe
1908 winmgr89.exe

pid	process
860	winmgr89.exe
1908	winmgr89.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Windows\\SysWOW64\\svchost.exe"	svchost.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe	autoit_exe

Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\SysWOW64\.Identifier svchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\.Identifier	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe

description	pid	process	target process
PID 1612 set thread context of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1972	schtasks.exe
984	schtasks.exe
2044	schtasks.exe
1604	schtasks.exe
1616	schtasks.exe
1980	schtasks.exe
1504	schtasks.exe
560	schtasks.exe
524	schtasks.exe
1204	schtasks.exe
1644	schtasks.exe
736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe

pid	process
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exetaskeng.exe

description	pid	process	target process
PID 1612 wrote to memory of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe
PID 1612 wrote to memory of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe
PID 1612 wrote to memory of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe
PID 1612 wrote to memory of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe
PID 1612 wrote to memory of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe
PID 1612 wrote to memory of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe
PID 1612 wrote to memory of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe
PID 1612 wrote to memory of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe
PID 1612 wrote to memory of 1956	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	svchost.exe
PID 1612 wrote to memory of 984	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 984	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 984	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 984	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1204	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1204	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1204	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1204	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1056 wrote to memory of 860	1056	taskeng.exe	winmgr89.exe
PID 1056 wrote to memory of 860	1056	taskeng.exe	winmgr89.exe
PID 1056 wrote to memory of 860	1056	taskeng.exe	winmgr89.exe
PID 1056 wrote to memory of 860	1056	taskeng.exe	winmgr89.exe
PID 1612 wrote to memory of 2044	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 2044	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 2044	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 2044	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1644	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1644	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1644	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1644	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1604	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1604	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1604	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1604	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1616	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1616	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1616	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1616	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1980	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1980	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1980	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1980	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1972	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1972	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1972	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1972	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1056 wrote to memory of 1908	1056	taskeng.exe	winmgr89.exe
PID 1056 wrote to memory of 1908	1056	taskeng.exe	winmgr89.exe
PID 1056 wrote to memory of 1908	1056	taskeng.exe	winmgr89.exe
PID 1056 wrote to memory of 1908	1056	taskeng.exe	winmgr89.exe
PID 1612 wrote to memory of 1504	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1504	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1504	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 1504	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 560	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 560	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 560	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 560	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 524	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 524	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 524	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 524	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 736	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 736	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe
PID 1612 wrote to memory of 736	1612	18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe
"C:\Users\Admin\AppData\Local\Temp\18df3cc6f2fc32277040460c85aaf927848e63abb3d005b43fcb8d0368a57214.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1956

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:984

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:1204

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:2044

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:1644

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:1604

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:1616

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:1980

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:1972

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:1504

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:560

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:524

C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr89.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe" /f
2⤵
- Creates scheduled task(s)
PID:736

C:\Windows\system32\taskeng.exe
taskeng.exe {384E554D-C92D-4202-B0A2-60D2C39C1729} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe
C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe
2⤵
- Executes dropped EXE
PID:860

C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe
C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe
2⤵
- Executes dropped EXE
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe
Filesize
1.6MB

MD5
35616d90e4da255743f5b3d0137de8d6

SHA1
4b2ff6ab9cd0c2758a354912821a87b3b058d0d7

SHA256
adacbac9c9e0ead716041f5943fbb7bb206c9ec8f45222794e8255b16ac160ca

SHA512
2f9bf19785e5fd7de8059521704c6e49c51e7dc17379c698e70702a94a5c1540c7e6b1abc15448f83af02c0c0960a36f16762e241d3754f083237ba0f7f39f6c

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe
Filesize
1.6MB

MD5
35616d90e4da255743f5b3d0137de8d6

SHA1
4b2ff6ab9cd0c2758a354912821a87b3b058d0d7

SHA256
adacbac9c9e0ead716041f5943fbb7bb206c9ec8f45222794e8255b16ac160ca

SHA512
2f9bf19785e5fd7de8059521704c6e49c51e7dc17379c698e70702a94a5c1540c7e6b1abc15448f83af02c0c0960a36f16762e241d3754f083237ba0f7f39f6c

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\winmgr89.exe
Filesize
1.6MB

MD5
35616d90e4da255743f5b3d0137de8d6

SHA1
4b2ff6ab9cd0c2758a354912821a87b3b058d0d7

SHA256
adacbac9c9e0ead716041f5943fbb7bb206c9ec8f45222794e8255b16ac160ca

SHA512
2f9bf19785e5fd7de8059521704c6e49c51e7dc17379c698e70702a94a5c1540c7e6b1abc15448f83af02c0c0960a36f16762e241d3754f083237ba0f7f39f6c

Download Submit
memory/524-85-0x0000000000000000-mapping.dmp

Download
memory/560-84-0x0000000000000000-mapping.dmp

Download
memory/736-86-0x0000000000000000-mapping.dmp

Download
memory/860-71-0x0000000000000000-mapping.dmp

Download
memory/984-67-0x0000000000000000-mapping.dmp

Download
memory/1204-69-0x0000000000000000-mapping.dmp

Download
memory/1504-83-0x0000000000000000-mapping.dmp

Download
memory/1604-76-0x0000000000000000-mapping.dmp

Download
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1616-77-0x0000000000000000-mapping.dmp

Download
memory/1644-75-0x0000000000000000-mapping.dmp

Download
memory/1908-80-0x0000000000000000-mapping.dmp

Download
memory/1956-66-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1956-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1956-62-0x0000000000401F8F-mapping.dmp

Download
memory/1956-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1956-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1956-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1956-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1956-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1956-55-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1972-79-0x0000000000000000-mapping.dmp

Download
memory/1980-78-0x0000000000000000-mapping.dmp

Download
memory/2044-74-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads