Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe
- Size 997KB
- Sample201110-l7sl6jybd2
- SHA256 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9
- MD5 3ceeda519a99e240b31b93ba7aabff60
- SHA1 865469f5a186efe95bd168d31c535f356a61faaa
- SHA512 709eb4a5513ed70a577ce674282d838a64641a2077e84e248bc57c1c22861610f0cb97740a7130962d0e6a58a2f42d22f4cb5a2eb39497b13a5fc93c0fd51d0b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
rem-pounds.ddns.net:9970
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPDMC.lnk bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3132 set thread context of 3976 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 78 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3976 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3132 wrote to memory of 3976 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 78 PID 3132 wrote to memory of 3976 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 78 PID 3132 wrote to memory of 3976 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 78 PID 3132 wrote to memory of 3976 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 78 PID 3132 wrote to memory of 3976 3132 bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe"C:\Users\Admin\AppData\Local\Temp\bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe"C:\Users\Admin\AppData\Local\Temp\bc9d22f91b7f032cac3a6a36c5d90b1878ec7ab87193fd83be388ea3cbe964f9.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3976
-