Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe
- Size 998KB
- Sample201110-2wsp7f6v2s
- SHA256 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4
- MD5 b2ea22fa53a82a242f62667674f1cdca
- SHA1 abec0526c16d17e94aabbf200d4d937531364553
- SHA512 8dd6dbc297bb49e98e001c8a850ee3108a65d6b3a5c5730e38d3a454a12319fce39b9d9cd786bdeee553d6f18d6552b500fdf45d350cbfa704980d17800cadd2
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
rem-pounds.ddns.net:9970
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPDMC.lnk ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 508 set thread context of 1020 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 78 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1020 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 508 wrote to memory of 1020 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 78 PID 508 wrote to memory of 1020 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 78 PID 508 wrote to memory of 1020 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 78 PID 508 wrote to memory of 1020 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 78 PID 508 wrote to memory of 1020 508 ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe"C:\Users\Admin\AppData\Local\Temp\ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe"C:\Users\Admin\AppData\Local\Temp\ab1c1d8c82b2e153de37cbc8450e30ef47e708b5304a5c988b5656152ffa86d4.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1020
-