Analysis
-
max time kernel
64s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-01-2021 09:01
Static task
static1
Behavioral task
behavioral1
Sample
PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe
Resource
win7v20201028
General
-
Target
PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe
-
Size
807KB
-
MD5
a3d8e6527b3cd4d2e74539af7918fc34
-
SHA1
cbc6e8e8e9c777b708350f4be1e14393d0c0551a
-
SHA256
d93d98295e3aebd631b2fd6d1a47ddd5ed0597343bf2c0ed870d6bdb59cb6192
-
SHA512
c6f81fc3c03c8939fdfcaea765171c2470170a91fe6a35165bc2cbf7ac18e6d5dba1876dbf2932e89f49ef593215ec2e57197464dfcc9daa893982f5c0684e9d
Malware Config
Extracted
remcos
212.83.46.26:4023
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exedescription pid process target process PID 1176 set thread context of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exepid process 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exedescription pid process Token: SeDebugPrivilege 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exedescription pid process target process PID 1176 wrote to memory of 540 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe schtasks.exe PID 1176 wrote to memory of 540 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe schtasks.exe PID 1176 wrote to memory of 540 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe schtasks.exe PID 1176 wrote to memory of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 1176 wrote to memory of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 1176 wrote to memory of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 1176 wrote to memory of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 1176 wrote to memory of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 1176 wrote to memory of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 1176 wrote to memory of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 1176 wrote to memory of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 1176 wrote to memory of 2752 1176 PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pAZrZLHJfxvYL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4789.tmp"2⤵
- Creates scheduled task(s)
PID:540 -
C:\Users\Admin\AppData\Local\Temp\PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\PO NO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"2⤵PID:2752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4789.tmpMD5
8293355cbcb551b144b10f76079dd687
SHA1223b14e10ac485776afa320dd16e0261dd4e6c43
SHA2567ef172fab7a799a9b3ea7f886cc3acebdcbfd02f3f5174803ec9ecf916417153
SHA512b922480e7f2723876726abbc6852d28ba6e11ccf1d1715c218c0296c8293f3451caafbc72f7794c17fe80dc864faee1435763ad8afe20305734812f0b2405202
-
memory/540-12-0x0000000000000000-mapping.dmp
-
memory/1176-6-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/1176-2-0x0000000073A70000-0x000000007415E000-memory.dmpFilesize
6.9MB
-
memory/1176-7-0x0000000005360000-0x0000000005361000-memory.dmpFilesize
4KB
-
memory/1176-8-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/1176-9-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/1176-10-0x0000000005500000-0x0000000005512000-memory.dmpFilesize
72KB
-
memory/1176-11-0x0000000006160000-0x00000000061B6000-memory.dmpFilesize
344KB
-
memory/1176-5-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/1176-3-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/2752-14-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2752-15-0x000000000040FD88-mapping.dmp
-
memory/2752-16-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB