Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 06:28
Static task
static1
Behavioral task
behavioral1
Sample
PO839-DOC83475348-834_pdf.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
PO839-DOC83475348-834_pdf.exe
Resource
win10
General
-
Target
PO839-DOC83475348-834_pdf.exe
-
Size
169KB
-
MD5
f0a88db6d16630640775a733efd9527f
-
SHA1
88fc7c4275f93c404efa073a80ce61e0e7f3ee5a
-
SHA256
ff3eb81477b36ac2239b623085961439379064929b20c4a69f72cb266adece83
-
SHA512
af00550e84d345289e6d1751f42be955a3d60a2e5a4f442764dfbb044b7e0c8d775e8af89c0d217bd8023d4a4739b77600ba9365f47cde5086afead6180f6ddf
Malware Config
Extracted
remcos
109.169.89.116:2021
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO839-DOC83475348-834_pdf.exedescription pid process Token: SeDebugPrivilege 676 PO839-DOC83475348-834_pdf.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
PO839-DOC83475348-834_pdf.exePO839-DOC83475348-834_pdf.exepid process 676 PO839-DOC83475348-834_pdf.exe 676 PO839-DOC83475348-834_pdf.exe 676 PO839-DOC83475348-834_pdf.exe 676 PO839-DOC83475348-834_pdf.exe 676 PO839-DOC83475348-834_pdf.exe 1568 PO839-DOC83475348-834_pdf.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
PO839-DOC83475348-834_pdf.exePO839-DOC83475348-834_pdf.exedescription pid process target process PID 676 set thread context of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 set thread context of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PO839-DOC83475348-834_pdf.exepid process 552 PO839-DOC83475348-834_pdf.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
PO839-DOC83475348-834_pdf.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools PO839-DOC83475348-834_pdf.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
PO839-DOC83475348-834_pdf.exePO839-DOC83475348-834_pdf.exedescription pid process target process PID 676 wrote to memory of 1756 676 PO839-DOC83475348-834_pdf.exe schtasks.exe PID 676 wrote to memory of 1756 676 PO839-DOC83475348-834_pdf.exe schtasks.exe PID 676 wrote to memory of 1756 676 PO839-DOC83475348-834_pdf.exe schtasks.exe PID 676 wrote to memory of 1756 676 PO839-DOC83475348-834_pdf.exe schtasks.exe PID 676 wrote to memory of 672 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 672 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 672 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 672 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 760 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 760 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 760 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 760 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 676 wrote to memory of 552 676 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1564 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1564 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1564 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1564 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1584 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1584 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1584 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1584 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1568 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1616 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1616 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1616 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1616 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1596 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1596 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1596 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe PID 552 wrote to memory of 1596 552 PO839-DOC83475348-834_pdf.exe PO839-DOC83475348-834_pdf.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
PO839-DOC83475348-834_pdf.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PO839-DOC83475348-834_pdf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PO839-DOC83475348-834_pdf.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
PO839-DOC83475348-834_pdf.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions PO839-DOC83475348-834_pdf.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
PO839-DOC83475348-834_pdf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum PO839-DOC83475348-834_pdf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 PO839-DOC83475348-834_pdf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Looks for VMWare Tools registry key
- Suspicious use of WriteProcessMemory
- Checks BIOS information in registry
- Looks for VirtualBox Guest Additions in registry
- Maps connected drives based on registry
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\stsVISqZItxBpu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6518.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exeC:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe /stext "C:\Users\Admin\AppData\Local\Temp\lnvmy"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exeC:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe /stext "C:\Users\Admin\AppData\Local\Temp\lnvmy"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exeC:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe /stext "C:\Users\Admin\AppData\Local\Temp\lnvmy"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exeC:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe /stext "C:\Users\Admin\AppData\Local\Temp\whifzckgx"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exeC:\Users\Admin\AppData\Local\Temp\PO839-DOC83475348-834_pdf.exe /stext "C:\Users\Admin\AppData\Local\Temp\gjoxrvvilapa"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6518.tmp
-
memory/552-4-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/552-5-0x0000000000413B74-mapping.dmp
-
memory/552-6-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/676-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1568-7-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/1568-8-0x0000000000471274-mapping.dmp
-
memory/1568-9-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/1568-10-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/1756-2-0x0000000000000000-mapping.dmp