Analysis
- max time kernel
150s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
14/11/2020, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe
- Size 998KB
- Sample201114-6csa44b5yn
- SHA256 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd
- MD5 76b128c37cf33f6efa96b09e624393b2
- SHA1 c67ee5a967dda1cf19607f42b8171b3264c2f1b3
- SHA512 a83a036b27b55b2cb5afb31871e2aae9477556ed3dcc75f55bfc9f3a6bc044da802df0bee878f59a634e19994ae6896c92ce5ebe6913fe02ca73610f6fa3c46b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
rem-pounds.ddns.net:9970
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPDMC.lnk ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1160 set thread context of 2388 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 79 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2388 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1160 wrote to memory of 2388 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 79 PID 1160 wrote to memory of 2388 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 79 PID 1160 wrote to memory of 2388 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 79 PID 1160 wrote to memory of 2388 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 79 PID 1160 wrote to memory of 2388 1160 ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe"C:\Users\Admin\AppData\Local\Temp\ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe"C:\Users\Admin\AppData\Local\Temp\ede4df828223bd9d9740da22e615642fe0e823e809d0fb45e2fed9d614716dbd.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2388
-