Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 08:40
Static task
static1
Behavioral task
behavioral1
Sample
purchase order for july.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
purchase order for july.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
purchase order for july.exe
-
Size
531KB
-
MD5
2b8ffa3d1e175136dbecbc64b2562294
-
SHA1
1f9f9a709fc9565ffea8b3f3a655a607aff03d28
-
SHA256
74c74bc92e1e2b1fbec04160533ddc46adfd8e2f691295ad4a08cbd83e01adc7
-
SHA512
be86d9ffca14908d42a7782664eb6eabc669c2b25ec6dd3ad332b934c860a7513773e6e85de1e084d3965ac839959b546a77dbf81e3526dc698e94386bc74802
Score
10/10
Malware Config
Extracted
Family
remcos
C2
194.5.97.18:6642
gozman11.duckdns.org:6642
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
purchase order for july.exechrome.exedescription pid process target process PID 3848 set thread context of 2080 3848 purchase order for july.exe purchase order for july.exe PID 3792 set thread context of 3924 3792 chrome.exe chrome.exe -
Executes dropped EXE 3 IoCs
Processes:
chrome.exechrome.exechrome.exepid process 3792 chrome.exe 3580 chrome.exe 3924 chrome.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
chrome.exedescription pid process Token: SeDebugPrivilege 3792 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
chrome.exepid process 3924 chrome.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
purchase order for july.exepurchase order for july.execmd.exechrome.exedescription pid process target process PID 3848 wrote to memory of 2080 3848 purchase order for july.exe purchase order for july.exe PID 3848 wrote to memory of 2080 3848 purchase order for july.exe purchase order for july.exe PID 3848 wrote to memory of 2080 3848 purchase order for july.exe purchase order for july.exe PID 3848 wrote to memory of 2080 3848 purchase order for july.exe purchase order for july.exe PID 3848 wrote to memory of 2080 3848 purchase order for july.exe purchase order for july.exe PID 3848 wrote to memory of 2080 3848 purchase order for july.exe purchase order for july.exe PID 3848 wrote to memory of 2080 3848 purchase order for july.exe purchase order for july.exe PID 3848 wrote to memory of 2080 3848 purchase order for july.exe purchase order for july.exe PID 3848 wrote to memory of 2080 3848 purchase order for july.exe purchase order for july.exe PID 2080 wrote to memory of 2576 2080 purchase order for july.exe cmd.exe PID 2080 wrote to memory of 2576 2080 purchase order for july.exe cmd.exe PID 2080 wrote to memory of 2576 2080 purchase order for july.exe cmd.exe PID 2576 wrote to memory of 3504 2576 cmd.exe PING.EXE PID 2576 wrote to memory of 3504 2576 cmd.exe PING.EXE PID 2576 wrote to memory of 3504 2576 cmd.exe PING.EXE PID 2576 wrote to memory of 3792 2576 cmd.exe chrome.exe PID 2576 wrote to memory of 3792 2576 cmd.exe chrome.exe PID 2576 wrote to memory of 3792 2576 cmd.exe chrome.exe PID 3792 wrote to memory of 3580 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3580 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3580 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3924 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3924 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3924 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3924 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3924 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3924 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3924 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3924 3792 chrome.exe chrome.exe PID 3792 wrote to memory of 3924 3792 chrome.exe chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 3792 chrome.exe 3792 chrome.exe -
Adds Run entry to start application 2 TTPs 4 IoCs
Processes:
purchase order for july.exechrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\ purchase order for july.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\chrome.exe\"" purchase order for july.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\chrome.exe\"" chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe"C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\purchase order for july.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:3504 -
C:\Users\Admin\AppData\Roaming\remcos\chrome.exe"C:\Users\Admin\AppData\Roaming\remcos\chrome.exe"4⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:3792 -
C:\Users\Admin\AppData\Roaming\remcos\chrome.exe"{path}"5⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Roaming\remcos\chrome.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
PID:3924