Analysis
- max time kernel
151s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
14/11/2020, 18:08
Static task
static1
Behavioral task
behavioral1
Sample
244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe
- Size 998KB
- Sample201114-hv87e362hx
- SHA256 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66
- MD5 53f5bf61ba44ce2091115233ca8d098f
- SHA1 76887a6ba45df4f76db0b68c58c5e1e6e66817a0
- SHA512 231b925dcd0e8aefa8f25eb880eb50dc81b891fc9b8064348282843cb72ea083636e61f67f8beb641f04fb0745b8898e48c6c16202e6b42d8f6b7adcd11dc3aa
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
rem-pounds.ddns.net:9970
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPDMC.lnk 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 580 set thread context of 204 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 78 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 204 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 580 wrote to memory of 204 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 78 PID 580 wrote to memory of 204 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 78 PID 580 wrote to memory of 204 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 78 PID 580 wrote to memory of 204 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 78 PID 580 wrote to memory of 204 580 244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe"C:\Users\Admin\AppData\Local\Temp\244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe"C:\Users\Admin\AppData\Local\Temp\244cba04a635e2eec50fa9fb0e6b4a1dc2169dfaddce3c9ba0ec893839a5aa66.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:204
-