Analysis
- max time kernel
149s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
18/12/2020, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
742d0fbf067bf70bb3857d52e32a14ee.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 742d0fbf067bf70bb3857d52e32a14ee.exe
- Size 1014KB
- Sample201218-vtgg9wae86
- SHA256 00a43037570aef0f977589fa679bf79627d04890fabfca6c19ae2c2f851ef289
- MD5 742d0fbf067bf70bb3857d52e32a14ee
- SHA1 3f8224bcafcb3ada45e51904cec76985dc71492f
- SHA512 5c1e458c842b8bf968d6903f1d8e9f368762801f41398c36c54881086e2f2b64c5b89d5dc510f3e809673670916883f1b4331880424423e705beb939431796a1
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
dominoduck2102.duckdns.org:9403
Signatures
- Blocklisted process makes network request 5 IoCs
flow pid Process 18 3580 cmd.exe 19 3580 cmd.exe 20 3580 cmd.exe 22 3580 cmd.exe 23 3580 cmd.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\HelpPane.job cmd.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 728 742d0fbf067bf70bb3857d52e32a14ee.exe 748 extrac32.exe 748 extrac32.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 748 extrac32.exe 748 extrac32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3580 cmd.exe - Suspicious use of WriteProcessMemory 168 IoCs
description pid Process procid_target PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 728 wrote to memory of 748 728 742d0fbf067bf70bb3857d52e32a14ee.exe 74 PID 748 wrote to memory of 3928 748 extrac32.exe 79 PID 748 wrote to memory of 3928 748 extrac32.exe 79 PID 748 wrote to memory of 3928 748 extrac32.exe 79 PID 748 wrote to memory of 3928 748 extrac32.exe 79 PID 748 wrote to memory of 3928 748 extrac32.exe 79 PID 748 wrote to memory of 3928 748 extrac32.exe 79 PID 748 wrote to memory of 3928 748 extrac32.exe 79 PID 748 wrote to memory of 3928 748 extrac32.exe 79 PID 748 wrote to memory of 3928 748 extrac32.exe 79 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80 PID 748 wrote to memory of 3580 748 extrac32.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\742d0fbf067bf70bb3857d52e32a14ee.exe"C:\Users\Admin\AppData\Local\Temp\742d0fbf067bf70bb3857d52e32a14ee.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\extrac32.exe"C:\Windows\system32\extrac32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3928
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3580
-
-