Analysis
- max time kernel
150s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
14/11/2020, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe
- Size 998KB
- Sample201114-2544782f52
- SHA256 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85
- MD5 c7770947e5b81dcf26e567641cdc258e
- SHA1 b38e7aed6853a6e08e4260f7e47fdaa5b2a58952
- SHA512 3ae24d3d0a6047a4164f2098c102011f4d8a9a835c6781853951b356d11627e71c44b724bd6570c4fc922d02ea3e7dade96f31ef09958f354884eeeadb4b77e9
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
rem-pounds.ddns.net:9970
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPDMC.lnk e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 492 set thread context of 2832 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 78 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2832 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 492 wrote to memory of 2832 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 78 PID 492 wrote to memory of 2832 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 78 PID 492 wrote to memory of 2832 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 78 PID 492 wrote to memory of 2832 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 78 PID 492 wrote to memory of 2832 492 e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe"C:\Users\Admin\AppData\Local\Temp\e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Local\Temp\e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe"C:\Users\Admin\AppData\Local\Temp\e55d4cea362b250043b90126dfe90c0e7e7f1f6b3a2937c5a516fdfe6d41ec85.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2832
-