Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 06:56
Static task
static1
Behavioral task
behavioral1
Sample
ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe
Resource
win10
General
-
Target
ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe
-
Size
269KB
-
MD5
de11b124fd6ddebb30c9424ffb07fa0b
-
SHA1
1209452da9bb0ac7e2728c5e22d9306e56f54b14
-
SHA256
7debbe024dbb6e548f266c653d22b6dfb1738615a4a7653eea9964d34d111eeb
-
SHA512
6de0e740d9f8e8aec8660ad552dfe85776ef6fc60d45b58c9ce08ca6cad440e84b1430157b2552b67682fb34829e0cf8a9ace6d54c307b7a1114e78a9f28351a
Malware Config
Extracted
remcos
recuperaciondecartera.website:6790
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1612 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
PXServiceNet.exePXServiceNet.exepid process 1524 PXServiceNet.exe 1840 PXServiceNet.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PXServiceNet.exepid process 1840 PXServiceNet.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exePXServiceNet.exedescription pid process target process PID 1092 set thread context of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1524 set thread context of 1840 1524 PXServiceNet.exe PXServiceNet.exe -
Adds Run entry to start application 2 TTPs 4 IoCs
Processes:
ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exePXServiceNet.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\MServices = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PXServiceNet.exe\"" ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PXServiceNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\MServices = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PXServiceNet.exe\"" PXServiceNet.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exePXServiceNet.exedescription pid process Token: SeDebugPrivilege 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe Token: SeDebugPrivilege 1524 PXServiceNet.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exePXServiceNet.exepid process 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe 1524 PXServiceNet.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exeADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exeWScript.execmd.exePXServiceNet.exedescription pid process target process PID 1092 wrote to memory of 1412 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1412 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1412 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1412 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1420 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1420 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1420 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1420 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 744 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 744 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 744 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 744 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1092 wrote to memory of 1436 1092 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe PID 1436 wrote to memory of 916 1436 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe WScript.exe PID 1436 wrote to memory of 916 1436 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe WScript.exe PID 1436 wrote to memory of 916 1436 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe WScript.exe PID 1436 wrote to memory of 916 1436 ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe WScript.exe PID 916 wrote to memory of 1612 916 WScript.exe cmd.exe PID 916 wrote to memory of 1612 916 WScript.exe cmd.exe PID 916 wrote to memory of 1612 916 WScript.exe cmd.exe PID 916 wrote to memory of 1612 916 WScript.exe cmd.exe PID 1612 wrote to memory of 1524 1612 cmd.exe PXServiceNet.exe PID 1612 wrote to memory of 1524 1612 cmd.exe PXServiceNet.exe PID 1612 wrote to memory of 1524 1612 cmd.exe PXServiceNet.exe PID 1612 wrote to memory of 1524 1612 cmd.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe PID 1524 wrote to memory of 1840 1524 PXServiceNet.exe PXServiceNet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"2⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"2⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"2⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"C:\Users\Admin\AppData\Local\Temp\ADJUNTO_EXTRACTO_75422514701354879545042432022154657988454047224024231254457878797857055454242204243.exe"2⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeC:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
PID:1840
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbs
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe
-
\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe
-
memory/916-6-0x0000000002600000-0x0000000002604000-memory.dmpFilesize
16KB
-
memory/916-3-0x0000000000000000-mapping.dmp
-
memory/1436-0-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1436-2-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1436-1-0x0000000000413B74-mapping.dmp
-
memory/1524-9-0x0000000000000000-mapping.dmp
-
memory/1612-5-0x0000000000000000-mapping.dmp
-
memory/1840-12-0x0000000000413B74-mapping.dmp
-
memory/1840-14-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB