Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/11/2020, 08:22
Static task
static1
Behavioral task
behavioral1
Sample
Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe
- Size 1.8MB
- Sample201119-xpdsd3yd9a
- SHA256 6f493867adbd74622c28e2c1e670b4c1f64566ea830dbf7bd0c5905b858a33c8
- MD5 da9cf305f26cf0748736fd063f56e801
- SHA1 8058d432c1b01f056786b62fb3e518f0c14192f5
- SHA512 4f79bbc53f7f1a6f08d7a4793bf58c447e8f62a3c6fa59185e53df007f43afac110d53ce15bc4585f6c33cd67a9c045eb7ecf2e301ae3ebe73bb158d5d17c936
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
databasepropersonombrecomercialideasearchwords.services:7580
Signatures
- ServiceHost packer 7 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/4032-97-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4032-98-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4032-100-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4032-101-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4032-99-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4032-102-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4032-103-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 3 IoCs
pid Process 4032 PxxoServicesNet.exe 3052 PxxoServicesNet.exe 796 PxxoServicesNet.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesNet.exe\"" Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesNet.exe\"" PxxoServicesNet.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
pid Process 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3988 set thread context of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 4032 set thread context of 796 4032 PxxoServicesNet.exe 87 - Program crash 2 IoCs
pid pid_target Process procid_target 2700 3988 WerFault.exe 68 3808 4032 WerFault.exe 82 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe 4032 PxxoServicesNet.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 796 PxxoServicesNet.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe Token: SeRestorePrivilege 2700 WerFault.exe Token: SeBackupPrivilege 2700 WerFault.exe Token: SeDebugPrivilege 2700 WerFault.exe Token: SeDebugPrivilege 4032 PxxoServicesNet.exe Token: SeDebugPrivilege 3808 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 796 PxxoServicesNet.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 3988 wrote to memory of 2160 3988 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 76 PID 2160 wrote to memory of 3680 2160 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 79 PID 2160 wrote to memory of 3680 2160 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 79 PID 2160 wrote to memory of 3680 2160 Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe 79 PID 3680 wrote to memory of 2704 3680 WScript.exe 80 PID 3680 wrote to memory of 2704 3680 WScript.exe 80 PID 3680 wrote to memory of 2704 3680 WScript.exe 80 PID 2704 wrote to memory of 4032 2704 cmd.exe 82 PID 2704 wrote to memory of 4032 2704 cmd.exe 82 PID 2704 wrote to memory of 4032 2704 cmd.exe 82 PID 4032 wrote to memory of 3052 4032 PxxoServicesNet.exe 86 PID 4032 wrote to memory of 3052 4032 PxxoServicesNet.exe 86 PID 4032 wrote to memory of 3052 4032 PxxoServicesNet.exe 86 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87 PID 4032 wrote to memory of 796 4032 PxxoServicesNet.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_084727993_69693424_605648848569050599788_7446052_6963949629025_8175427325491_pdf.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"6⤵
- Executes dropped EXE
PID:3052
-
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 11726⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 11642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-