Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20201028 - submitted
14/11/2020, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe
- Size 998KB
- Sample201114-g48htqncma
- SHA256 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657
- MD5 8e1fd1d012b2f8c746aff29dd4cfcdf8
- SHA1 79396317d19d1a97f44931d82efedc8cbf2f2596
- SHA512 e8da1d0c5e529d9617a9d00b95d26fb18516d3d3d223c039e664be7c33e1d16e461e15d09ad4f526c05ce31f1319f2ee50b0ba2a130467fec46f091599d7ab3b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
rem-pounds.ddns.net:9970
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPDMC.lnk 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1124 set thread context of 200 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 78 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 200 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1124 wrote to memory of 200 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 78 PID 1124 wrote to memory of 200 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 78 PID 1124 wrote to memory of 200 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 78 PID 1124 wrote to memory of 200 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 78 PID 1124 wrote to memory of 200 1124 21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe"C:\Users\Admin\AppData\Local\Temp\21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe"C:\Users\Admin\AppData\Local\Temp\21fa4760bc1c9c69289afb33eac0afd7d3ecd74716e5e9963dbebe797aa93657.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:200
-