Analysis
- max time kernel
149s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/11/2020, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe
- Size 2.0MB
- Sample201119-53nxxvb9y6
- SHA256 ea7caecf45fc75ba512efd3cf878800893c2a43ae66fc0a9a452687ba26c1025
- MD5 4dfc3cf849a698f44db1e5599191e517
- SHA1 82ca8a7f0cc21fdb8b9840254d9386a7bbb35ae6
- SHA512 4731e5713a1f674c4f2af660e7ac876376da5d3b281a7b659deb10a72fbb9d8b432de2a5ce341a42f05f61c44fdd8f58d63daeda2bc04a38759b549973ce490f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
databasepropersonombrecomercialideasearchwords.services:7580
Signatures
- ServiceHost packer 7 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/3980-36-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-35-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-37-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-38-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-33-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-34-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-32-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 3980 PxxoServicesNet.exe 2932 PxxoServicesNet.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesNet.exe\"" PxxoServicesNet.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesNet.exe\"" Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesNet.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
pid Process 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 3980 PxxoServicesNet.exe 3980 PxxoServicesNet.exe 3980 PxxoServicesNet.exe 3980 PxxoServicesNet.exe 3980 PxxoServicesNet.exe 3980 PxxoServicesNet.exe 3980 PxxoServicesNet.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 796 set thread context of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 3980 set thread context of 2932 3980 PxxoServicesNet.exe 84 - Program crash 2 IoCs
pid pid_target Process procid_target 4060 796 WerFault.exe 67 1764 3980 WerFault.exe 81 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 4060 WerFault.exe 3980 PxxoServicesNet.exe 3980 PxxoServicesNet.exe 3980 PxxoServicesNet.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe Token: SeRestorePrivilege 4060 WerFault.exe Token: SeBackupPrivilege 4060 WerFault.exe Token: SeDebugPrivilege 4060 WerFault.exe Token: SeDebugPrivilege 3980 PxxoServicesNet.exe Token: SeDebugPrivilege 1764 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2932 PxxoServicesNet.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 796 wrote to memory of 2652 796 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 75 PID 2652 wrote to memory of 2848 2652 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 78 PID 2652 wrote to memory of 2848 2652 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 78 PID 2652 wrote to memory of 2848 2652 Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe 78 PID 2848 wrote to memory of 2344 2848 WScript.exe 79 PID 2848 wrote to memory of 2344 2848 WScript.exe 79 PID 2848 wrote to memory of 2344 2848 WScript.exe 79 PID 2344 wrote to memory of 3980 2344 cmd.exe 81 PID 2344 wrote to memory of 3980 2344 cmd.exe 81 PID 2344 wrote to memory of 3980 2344 cmd.exe 81 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84 PID 3980 wrote to memory of 2932 3980 PxxoServicesNet.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0565048607_5104702_23918226873513229_945916769_9361784995141114_659091236144_pdf.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 11686⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 11562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060
-