Analysis
- max time kernel
149s - max time network
148s - platform
windows10_x64 - resource
win10 - submitted
06/07/2020, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe
- Size 994KB
- Sample200706-sj4v3cft76
- SHA256 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b
- MD5 fdd5c7b14888c497a41a06539f9e531f
- SHA1 772f96132f7dac30ac091f897935729b3c8f52da
- SHA512 a804daf45aeb607c043d5928a25a3bee3e75d4eace67a405a891ef4b0a172a42d097eb0c25cd6ba2bb259490f47f7c7b621196f0ee3dfcab2bc6fa23353ebaa1
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
rem-pounds.ddns.net:9970
Signatures
- Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3300 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 67 PID 2460 wrote to memory of 3300 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 67 PID 2460 wrote to memory of 3300 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 67 PID 2460 wrote to memory of 3300 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 67 PID 2460 wrote to memory of 3300 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 67 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2460 set thread context of 3300 2460 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe 67 - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3300 c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPDMC.lnk c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe"C:\Users\Admin\AppData\Local\Temp\c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Drops startup file
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe"C:\Users\Admin\AppData\Local\Temp\c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3300
-