Analysis
- max time kernel
148s - max time network
143s - platform
windows7_x64 - resource
win7 - submitted
09/07/2020, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
purchase order for july.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
purchase order for july.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target purchase order for july.exe
- Size 531KB
- Sample200709-frvs7exrtx
- SHA256 74c74bc92e1e2b1fbec04160533ddc46adfd8e2f691295ad4a08cbd83e01adc7
- MD5 2b8ffa3d1e175136dbecbc64b2562294
- SHA1 1f9f9a709fc9565ffea8b3f3a655a607aff03d28
- SHA512 be86d9ffca14908d42a7782664eb6eabc669c2b25ec6dd3ad332b934c860a7513773e6e85de1e084d3965ac839959b546a77dbf81e3526dc698e94386bc74802
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
194.5.97.18:6642
-
gozman11.duckdns.org:6642
Signatures
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 1044 PING.EXE - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1312 wrote to memory of 1536 1312 purchase order for july.exe 24 PID 1536 wrote to memory of 748 1536 purchase order for july.exe 25 PID 1536 wrote to memory of 748 1536 purchase order for july.exe 25 PID 1536 wrote to memory of 748 1536 purchase order for july.exe 25 PID 1536 wrote to memory of 748 1536 purchase order for july.exe 25 PID 1536 wrote to memory of 748 1536 purchase order for july.exe 25 PID 1536 wrote to memory of 748 1536 purchase order for july.exe 25 PID 1536 wrote to memory of 748 1536 purchase order for july.exe 25 PID 748 wrote to memory of 1044 748 cmd.exe 27 PID 748 wrote to memory of 1044 748 cmd.exe 27 PID 748 wrote to memory of 1044 748 cmd.exe 27 PID 748 wrote to memory of 1044 748 cmd.exe 27 PID 748 wrote to memory of 1512 748 cmd.exe 28 PID 748 wrote to memory of 1512 748 cmd.exe 28 PID 748 wrote to memory of 1512 748 cmd.exe 28 PID 748 wrote to memory of 1512 748 cmd.exe 28 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 PID 1512 wrote to memory of 1648 1512 chrome.exe 31 - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1312 set thread context of 1536 1312 purchase order for july.exe 24 PID 1512 set thread context of 1648 1512 chrome.exe 31 - Loads dropped DLL 1 IoCs
pid Process 748 cmd.exe - Executes dropped EXE 2 IoCs
pid Process 1512 chrome.exe 1648 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1648 chrome.exe - Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\ purchase order for july.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\chrome.exe\"" purchase order for july.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\chrome.exe\"" chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe"C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:748 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:1044
-
-
C:\Users\Admin\AppData\Roaming\remcos\chrome.exe"C:\Users\Admin\AppData\Roaming\remcos\chrome.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Roaming\remcos\chrome.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
PID:1648
-
-
-
-