Analysis
- max time kernel
114s - max time network
113s - platform
windows10_x64 - resource
win10v200722 - submitted
14/10/2020, 16:20
General
- Target Remittance.com.exe
- Size 295KB
- Sample201014-nz7qy5tg86
- SHA256 91292df65ea051a8cd7009382fb66c6b3fed39e8ddc3a27e38c990e2b69ea942
Score
9/10
Malware Config
Signatures
- ServiceHost packer 11 IoCs
Detects ServiceHost packer used for .NET malware
- Executes dropped EXE 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remittance.com.exe"C:\Users\Admin\AppData\Local\Temp\Remittance.com.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\ebbbik\Otuhgn.exe"C:\Users\Admin\Documents\ebbbik\Otuhgn.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 12603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/192-21-0x0000000005030000-0x0000000005031000-memory.dmp
memory/192-33-0x0000000005A90000-0x0000000005A91000-memory.dmp
memory/408-1-0x0000000000E30000-0x0000000000E31000-memory.dmp
memory/408-3-0x0000000005DF0000-0x0000000005DF1000-memory.dmp
memory/408-4-0x0000000005800000-0x0000000005801000-memory.dmp
memory/408-5-0x00000000057F0000-0x00000000057F1000-memory.dmp
memory/408-6-0x0000000005D00000-0x0000000005D04000-memory.dmp
memory/408-7-0x00000000073F0000-0x0000000007423000-memory.dmp
memory/408-0-0x0000000073440000-0x0000000073B2E000-memory.dmp
memory/3084-12-0x0000000073440000-0x0000000073B2E000-memory.dmp