Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-01-2021 18:37
Static task
static1
Behavioral task
behavioral1
Sample
PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe
Resource
win7v20201028
General
-
Target
PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe
-
Size
771KB
-
MD5
81338cc1ec365407ac22a6eab3ece373
-
SHA1
29f4ca9ec7fa628cea899292ac517f3852361f5d
-
SHA256
6a2ffd2b362dd38d2518163bd6c849366ab37d38a446845cc9789dcd02f8e7db
-
SHA512
0b66cbf636ccd22a4b3aab1d4bdd5357fd944de5647314d0023b7220ccc87379d59f15811c14f66a7163fcb14afcbd118ef9023686b1e485d1df9074b93c96ea
Malware Config
Extracted
remcos
212.83.46.26:4023
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exedescription pid process target process PID 892 set thread context of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exepid process 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exedescription pid process Token: SeDebugPrivilege 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exedescription pid process target process PID 892 wrote to memory of 1220 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe schtasks.exe PID 892 wrote to memory of 1220 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe schtasks.exe PID 892 wrote to memory of 1220 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe schtasks.exe PID 892 wrote to memory of 1220 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe schtasks.exe PID 892 wrote to memory of 332 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 332 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 332 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 332 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 2008 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 2008 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 2008 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 2008 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PID 892 wrote to memory of 556 892 PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DxrQHPLzs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC02.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\PO. MKL1-20-06053 & TECHNICAL SPECIFICATION.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC02.tmpMD5
046ef21fee26a0ad0a24b7c18d7be337
SHA1cca87d5ba4fd0557a274f9d5cbeeb136d97359e9
SHA25680d9ac393ba637d05fb0d7061abc0914d599fc5dbfcc9a8d989a7d53f3aff808
SHA51219b2cb9fe645387edb5c0971ef99854e153beb9ef41689434818adc71dc38930204b5ca9bb4eab5e9ff8ee1945cf378454fba71ca1d86e725b079205724cd119
-
memory/556-9-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/556-10-0x000000000040FD88-mapping.dmp
-
memory/556-11-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/892-2-0x0000000074520000-0x0000000074C0E000-memory.dmpFilesize
6.9MB
-
memory/892-3-0x00000000011D0000-0x00000000011D1000-memory.dmpFilesize
4KB
-
memory/892-5-0x00000000003A0000-0x00000000003B2000-memory.dmpFilesize
72KB
-
memory/892-6-0x00000000052A0000-0x00000000052F7000-memory.dmpFilesize
348KB
-
memory/1220-7-0x0000000000000000-mapping.dmp