Analysis
- max time kernel
149s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe
- Size 997KB
- Sample201110-7dxvfyccmj
- SHA256 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13
- MD5 a2da110172f0c319cb6472a5d43dff7e
- SHA1 9272ab42587b49a3bc9a1dc9c0d7b3e391468a15
- SHA512 f6b281ca47c2ab0dcbbc7bde7bb41117d43d7fc1691f713208e87017286a87e0e964911d466dbc3fe100943d4193b2da13eeb2cffc702ecd5a6d5d3ae3a870e3
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
rem-pounds.ddns.net:9970
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPDMC.lnk 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 984 set thread context of 736 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 78 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 736 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 984 wrote to memory of 736 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 78 PID 984 wrote to memory of 736 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 78 PID 984 wrote to memory of 736 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 78 PID 984 wrote to memory of 736 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 78 PID 984 wrote to memory of 736 984 38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe"C:\Users\Admin\AppData\Local\Temp\38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe"C:\Users\Admin\AppData\Local\Temp\38bdd57bd48d6b9f1179088787b216489adff1d6d0f1539b17d3ddae7ebdba13.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:736
-