Analysis
- max time kernel
148s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
20/11/2020, 07:41
Static task
static1
Behavioral task
behavioral1
Sample
Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe
- Size 1.9MB
- Sample201120-vt8lftwgrx
- SHA256 13efba52e6268bbc8089e143010d3e9be11ef8c7606a6ecd32b36e9ff60d1bde
- MD5 5b862afb58e54886e055d0de5110e670
- SHA1 67fdc5ae1621d50c600f8429f27750b17bfa1196
- SHA512 948d99c0f7591e142a158096684480bbe2536750bfcebdebccb1426c959331b1eaa786b7b0b4c041e9ad74511ead257cdc11162cfc95ab02ce7d57849d7f0d12
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
databasepropersonombrecomercialideasearchwords.services:7580
Signatures
- ServiceHost packer 7 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/884-33-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/884-32-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/884-34-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/884-35-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/884-36-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/884-37-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/884-38-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 884 PxxoServicesNet.exe 1812 PxxoServicesNet.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesNet.exe\"" Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesNet.exe\"" PxxoServicesNet.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
pid Process 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 884 PxxoServicesNet.exe 884 PxxoServicesNet.exe 884 PxxoServicesNet.exe 884 PxxoServicesNet.exe 884 PxxoServicesNet.exe 884 PxxoServicesNet.exe 884 PxxoServicesNet.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4756 set thread context of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 884 set thread context of 1812 884 PxxoServicesNet.exe 85 - Program crash 2 IoCs
pid pid_target Process procid_target 4272 4756 WerFault.exe 67 2144 884 WerFault.exe 81 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 884 PxxoServicesNet.exe 884 PxxoServicesNet.exe 884 PxxoServicesNet.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe 2144 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1812 PxxoServicesNet.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe Token: SeRestorePrivilege 4272 WerFault.exe Token: SeBackupPrivilege 4272 WerFault.exe Token: SeDebugPrivilege 4272 WerFault.exe Token: SeDebugPrivilege 884 PxxoServicesNet.exe Token: SeDebugPrivilege 2144 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1812 PxxoServicesNet.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 4756 wrote to memory of 812 4756 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 75 PID 812 wrote to memory of 3252 812 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 77 PID 812 wrote to memory of 3252 812 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 77 PID 812 wrote to memory of 3252 812 Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe 77 PID 3252 wrote to memory of 836 3252 WScript.exe 79 PID 3252 wrote to memory of 836 3252 WScript.exe 79 PID 3252 wrote to memory of 836 3252 WScript.exe 79 PID 836 wrote to memory of 884 836 cmd.exe 81 PID 836 wrote to memory of 884 836 cmd.exe 81 PID 836 wrote to memory of 884 836 cmd.exe 81 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85 PID 884 wrote to memory of 1812 884 PxxoServicesNet.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe"C:\Users\Admin\AppData\Local\Temp\Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe"C:\Users\Admin\AppData\Local\Temp\Extracto_Serfinanza_6961345687367774173000646384_53109195241037624566418_4169709175494611875002646_3.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesNet.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 11646⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 11602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272
-