Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-01-2021 18:00
Static task
static1
Behavioral task
behavioral1
Sample
ACTION2021.scr
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ACTION2021.scr
Resource
win10v20201028
General
-
Target
ACTION2021.scr
-
Size
1.4MB
-
MD5
c6ed7e791f0c36826d3c55e196dd7bd4
-
SHA1
97e94a141b7d479fd14373f724ce3232c2b0c429
-
SHA256
c39bdd8f7c69c3140ef920e2b1d5965310058c5fa425b871f4d7751d8291d55e
-
SHA512
17b21afde88b6d4ebb2340da7fb506ee62da93172e62e8da7bd4cf505fbe0df305f65523b555b9804d938411f00571a2718ec4ca900482c264173e2a42121a4f
Malware Config
Extracted
remcos
masters4733.sytes.net:8686
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
start.exestart.exepid process 1188 start.exe 1896 start.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ACTION2021.scrstart.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\start = "\"C:\\Users\\Admin\\AppData\\Roaming\\start\\start.exe\"" ACTION2021.scr Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ start.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\start = "\"C:\\Users\\Admin\\AppData\\Roaming\\start\\start.exe\"" start.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ACTION2021.scr -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ACTION2021.scrstart.exedescription pid process target process PID 4800 set thread context of 4284 4800 ACTION2021.scr ACTION2021.scr PID 1188 set thread context of 1896 1188 start.exe start.exe -
Modifies registry class 1 IoCs
Processes:
ACTION2021.scrdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings ACTION2021.scr -
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
start.exepid process 1896 start.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
ACTION2021.scrACTION2021.scrcmd.exeWScript.execmd.exestart.exestart.execmd.exedescription pid process target process PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4800 wrote to memory of 4284 4800 ACTION2021.scr ACTION2021.scr PID 4284 wrote to memory of 4360 4284 ACTION2021.scr cmd.exe PID 4284 wrote to memory of 4360 4284 ACTION2021.scr cmd.exe PID 4284 wrote to memory of 4360 4284 ACTION2021.scr cmd.exe PID 4360 wrote to memory of 3284 4360 cmd.exe reg.exe PID 4360 wrote to memory of 3284 4360 cmd.exe reg.exe PID 4360 wrote to memory of 3284 4360 cmd.exe reg.exe PID 4284 wrote to memory of 684 4284 ACTION2021.scr WScript.exe PID 4284 wrote to memory of 684 4284 ACTION2021.scr WScript.exe PID 4284 wrote to memory of 684 4284 ACTION2021.scr WScript.exe PID 684 wrote to memory of 8 684 WScript.exe cmd.exe PID 684 wrote to memory of 8 684 WScript.exe cmd.exe PID 684 wrote to memory of 8 684 WScript.exe cmd.exe PID 8 wrote to memory of 1188 8 cmd.exe start.exe PID 8 wrote to memory of 1188 8 cmd.exe start.exe PID 8 wrote to memory of 1188 8 cmd.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1188 wrote to memory of 1896 1188 start.exe start.exe PID 1896 wrote to memory of 2324 1896 start.exe cmd.exe PID 1896 wrote to memory of 2324 1896 start.exe cmd.exe PID 1896 wrote to memory of 2324 1896 start.exe cmd.exe PID 2324 wrote to memory of 2560 2324 cmd.exe reg.exe PID 2324 wrote to memory of 2560 2324 cmd.exe reg.exe PID 2324 wrote to memory of 2560 2324 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ACTION2021.scr"C:\Users\Admin\AppData\Local\Temp\ACTION2021.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ACTION2021.scr"C:\Users\Admin\AppData\Local\Temp\ACTION2021.scr"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\start\start.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\start\start.exeC:\Users\Admin\AppData\Roaming\start\start.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\start\start.exe"C:\Users\Admin\AppData\Roaming\start\start.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f8⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a9df62f02c776af7a9eb2a1f9a4fb408
SHA1e6f5add446a134ff353d10eff8ea26f30b7cd839
SHA256196620c6cc4a5f5382d44d597229d72ac5fe42e1e4e9faa63527d414fedc8e86
SHA5128c7d143dc9c623246148b8e7dd8e0487fb6988a12e9614b37c48246e501c88c946001edcdf019201c89b8fe5dd3604674dfd8d96c4ae1b706ac48c64c09dae07
-
C:\Users\Admin\AppData\Roaming\start\start.exeMD5
c6ed7e791f0c36826d3c55e196dd7bd4
SHA197e94a141b7d479fd14373f724ce3232c2b0c429
SHA256c39bdd8f7c69c3140ef920e2b1d5965310058c5fa425b871f4d7751d8291d55e
SHA51217b21afde88b6d4ebb2340da7fb506ee62da93172e62e8da7bd4cf505fbe0df305f65523b555b9804d938411f00571a2718ec4ca900482c264173e2a42121a4f
-
C:\Users\Admin\AppData\Roaming\start\start.exeMD5
c6ed7e791f0c36826d3c55e196dd7bd4
SHA197e94a141b7d479fd14373f724ce3232c2b0c429
SHA256c39bdd8f7c69c3140ef920e2b1d5965310058c5fa425b871f4d7751d8291d55e
SHA51217b21afde88b6d4ebb2340da7fb506ee62da93172e62e8da7bd4cf505fbe0df305f65523b555b9804d938411f00571a2718ec4ca900482c264173e2a42121a4f
-
C:\Users\Admin\AppData\Roaming\start\start.exeMD5
c6ed7e791f0c36826d3c55e196dd7bd4
SHA197e94a141b7d479fd14373f724ce3232c2b0c429
SHA256c39bdd8f7c69c3140ef920e2b1d5965310058c5fa425b871f4d7751d8291d55e
SHA51217b21afde88b6d4ebb2340da7fb506ee62da93172e62e8da7bd4cf505fbe0df305f65523b555b9804d938411f00571a2718ec4ca900482c264173e2a42121a4f
-
memory/8-17-0x0000000000000000-mapping.dmp
-
memory/684-15-0x0000000000000000-mapping.dmp
-
memory/1188-21-0x00000000739D0000-0x00000000740BE000-memory.dmpFilesize
6.9MB
-
memory/1188-18-0x0000000000000000-mapping.dmp
-
memory/1896-30-0x0000000000413FA4-mapping.dmp
-
memory/1896-32-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2324-33-0x0000000000000000-mapping.dmp
-
memory/2560-34-0x0000000000000000-mapping.dmp
-
memory/3284-14-0x0000000000000000-mapping.dmp
-
memory/4284-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4284-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4284-11-0x0000000000413FA4-mapping.dmp
-
memory/4360-13-0x0000000000000000-mapping.dmp
-
memory/4800-7-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/4800-2-0x00000000739D0000-0x00000000740BE000-memory.dmpFilesize
6.9MB
-
memory/4800-5-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/4800-3-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/4800-9-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/4800-8-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/4800-6-0x0000000004A60000-0x0000000004A8C000-memory.dmpFilesize
176KB