Analysis
- max time kernel
150s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
c5ca39215eddb502405c7c3862264601.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target c5ca39215eddb502405c7c3862264601.exe
- Size 880KB
- Sample201109-ddvlbehdja
- SHA256 26448f5f651589c5fd39721e68693c8eba2ada59eee363b365b984e90f0a47b0
- MD5 c5ca39215eddb502405c7c3862264601
- SHA1 a92ab433d7e109ac4a1d913d6f8bc88e18ca80b0
- SHA512 ad84bcc6ddaa6d320fc11ae1821f7b523e6f8dd952600a03014659a3ca20a89a583dcd36852ce4831a132b313a03b551b6d544913a8be46470745b49e4253b76
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
37.1.222.252:5851
Signatures
- Blacklisted process makes network request 5 IoCs
flow pid Process 23 436 cmd.exe 24 436 cmd.exe 28 436 cmd.exe 29 436 cmd.exe 30 436 cmd.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\runonce.job cmd.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4756 c5ca39215eddb502405c7c3862264601.exe 5068 extrac32.exe 5068 extrac32.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 5068 extrac32.exe 5068 extrac32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 436 cmd.exe - Suspicious use of WriteProcessMemory 168 IoCs
description pid Process procid_target PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 4756 wrote to memory of 5068 4756 c5ca39215eddb502405c7c3862264601.exe 73 PID 5068 wrote to memory of 2088 5068 extrac32.exe 79 PID 5068 wrote to memory of 2088 5068 extrac32.exe 79 PID 5068 wrote to memory of 2088 5068 extrac32.exe 79 PID 5068 wrote to memory of 2088 5068 extrac32.exe 79 PID 5068 wrote to memory of 2088 5068 extrac32.exe 79 PID 5068 wrote to memory of 2088 5068 extrac32.exe 79 PID 5068 wrote to memory of 2088 5068 extrac32.exe 79 PID 5068 wrote to memory of 2088 5068 extrac32.exe 79 PID 5068 wrote to memory of 2088 5068 extrac32.exe 79 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80 PID 5068 wrote to memory of 436 5068 extrac32.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5ca39215eddb502405c7c3862264601.exe"C:\Users\Admin\AppData\Local\Temp\c5ca39215eddb502405c7c3862264601.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\extrac32.exe"C:\Windows\system32\extrac32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5068 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2088
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:436
-
-