Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:06
Static task
static1
Behavioral task
behavioral1
Sample
75288df36386c8ce9ad16ff78d6cf3ca.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
75288df36386c8ce9ad16ff78d6cf3ca.exe
Resource
win10v20201028
General
-
Target
75288df36386c8ce9ad16ff78d6cf3ca.exe
-
Size
1.3MB
-
MD5
75288df36386c8ce9ad16ff78d6cf3ca
-
SHA1
3f8553a2bfeac57bb76cb4e2050d3aa7fa0a111a
-
SHA256
86c9b8f7003a77106c1746a855da645783d6ed30fffa45350554ab2edd0e1290
-
SHA512
7701c1630fa0c19afb98321dc9af635e64080dcbefb356f95051165e84dd27405a919a8ae77e5d38a568a7ce24b9977cd61c45920315c82a73b760080704b0f6
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
vlc.exevlc.exevlc.exepid process 432 vlc.exe 2568 vlc.exe 2836 vlc.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
75288df36386c8ce9ad16ff78d6cf3ca.exevlc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" 75288df36386c8ce9ad16ff78d6cf3ca.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 75288df36386c8ce9ad16ff78d6cf3ca.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
75288df36386c8ce9ad16ff78d6cf3ca.exevlc.exepid process 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
75288df36386c8ce9ad16ff78d6cf3ca.exevlc.exedescription pid process target process PID 4700 set thread context of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 432 set thread context of 2836 432 vlc.exe vlc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3904 4700 WerFault.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe 4588 432 WerFault.exe vlc.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4060 timeout.exe 1596 timeout.exe 1748 timeout.exe 2356 timeout.exe 3444 timeout.exe 3220 timeout.exe -
Modifies registry class 1 IoCs
Processes:
75288df36386c8ce9ad16ff78d6cf3ca.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings 75288df36386c8ce9ad16ff78d6cf3ca.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
75288df36386c8ce9ad16ff78d6cf3ca.exeWerFault.exevlc.exeWerFault.exepid process 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 432 vlc.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2836 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
75288df36386c8ce9ad16ff78d6cf3ca.exeWerFault.exevlc.exeWerFault.exedescription pid process Token: SeDebugPrivilege 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe Token: SeRestorePrivilege 3904 WerFault.exe Token: SeBackupPrivilege 3904 WerFault.exe Token: SeDebugPrivilege 3904 WerFault.exe Token: SeDebugPrivilege 432 vlc.exe Token: SeDebugPrivilege 4588 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2836 vlc.exe -
Suspicious use of WriteProcessMemory 68 IoCs
Processes:
75288df36386c8ce9ad16ff78d6cf3ca.execmd.execmd.execmd.exe75288df36386c8ce9ad16ff78d6cf3ca.exeWScript.execmd.exevlc.execmd.execmd.execmd.exedescription pid process target process PID 4700 wrote to memory of 3516 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe cmd.exe PID 4700 wrote to memory of 3516 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe cmd.exe PID 4700 wrote to memory of 3516 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe cmd.exe PID 3516 wrote to memory of 3444 3516 cmd.exe timeout.exe PID 3516 wrote to memory of 3444 3516 cmd.exe timeout.exe PID 3516 wrote to memory of 3444 3516 cmd.exe timeout.exe PID 4700 wrote to memory of 788 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe cmd.exe PID 4700 wrote to memory of 788 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe cmd.exe PID 4700 wrote to memory of 788 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe cmd.exe PID 788 wrote to memory of 3220 788 cmd.exe timeout.exe PID 788 wrote to memory of 3220 788 cmd.exe timeout.exe PID 788 wrote to memory of 3220 788 cmd.exe timeout.exe PID 4700 wrote to memory of 4208 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe cmd.exe PID 4700 wrote to memory of 4208 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe cmd.exe PID 4700 wrote to memory of 4208 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe cmd.exe PID 4208 wrote to memory of 4060 4208 cmd.exe timeout.exe PID 4208 wrote to memory of 4060 4208 cmd.exe timeout.exe PID 4208 wrote to memory of 4060 4208 cmd.exe timeout.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 4700 wrote to memory of 560 4700 75288df36386c8ce9ad16ff78d6cf3ca.exe 75288df36386c8ce9ad16ff78d6cf3ca.exe PID 560 wrote to memory of 2112 560 75288df36386c8ce9ad16ff78d6cf3ca.exe WScript.exe PID 560 wrote to memory of 2112 560 75288df36386c8ce9ad16ff78d6cf3ca.exe WScript.exe PID 560 wrote to memory of 2112 560 75288df36386c8ce9ad16ff78d6cf3ca.exe WScript.exe PID 2112 wrote to memory of 4448 2112 WScript.exe cmd.exe PID 2112 wrote to memory of 4448 2112 WScript.exe cmd.exe PID 2112 wrote to memory of 4448 2112 WScript.exe cmd.exe PID 4448 wrote to memory of 432 4448 cmd.exe vlc.exe PID 4448 wrote to memory of 432 4448 cmd.exe vlc.exe PID 4448 wrote to memory of 432 4448 cmd.exe vlc.exe PID 432 wrote to memory of 1324 432 vlc.exe cmd.exe PID 432 wrote to memory of 1324 432 vlc.exe cmd.exe PID 432 wrote to memory of 1324 432 vlc.exe cmd.exe PID 1324 wrote to memory of 1596 1324 cmd.exe timeout.exe PID 1324 wrote to memory of 1596 1324 cmd.exe timeout.exe PID 1324 wrote to memory of 1596 1324 cmd.exe timeout.exe PID 432 wrote to memory of 1816 432 vlc.exe cmd.exe PID 432 wrote to memory of 1816 432 vlc.exe cmd.exe PID 432 wrote to memory of 1816 432 vlc.exe cmd.exe PID 1816 wrote to memory of 1748 1816 cmd.exe timeout.exe PID 1816 wrote to memory of 1748 1816 cmd.exe timeout.exe PID 1816 wrote to memory of 1748 1816 cmd.exe timeout.exe PID 432 wrote to memory of 2196 432 vlc.exe cmd.exe PID 432 wrote to memory of 2196 432 vlc.exe cmd.exe PID 432 wrote to memory of 2196 432 vlc.exe cmd.exe PID 2196 wrote to memory of 2356 2196 cmd.exe timeout.exe PID 2196 wrote to memory of 2356 2196 cmd.exe timeout.exe PID 2196 wrote to memory of 2356 2196 cmd.exe timeout.exe PID 432 wrote to memory of 2568 432 vlc.exe vlc.exe PID 432 wrote to memory of 2568 432 vlc.exe vlc.exe PID 432 wrote to memory of 2568 432 vlc.exe vlc.exe PID 432 wrote to memory of 2836 432 vlc.exe vlc.exe PID 432 wrote to memory of 2836 432 vlc.exe vlc.exe PID 432 wrote to memory of 2836 432 vlc.exe vlc.exe PID 432 wrote to memory of 2836 432 vlc.exe vlc.exe PID 432 wrote to memory of 2836 432 vlc.exe vlc.exe PID 432 wrote to memory of 2836 432 vlc.exe vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75288df36386c8ce9ad16ff78d6cf3ca.exe"C:\Users\Admin\AppData\Local\Temp\75288df36386c8ce9ad16ff78d6cf3ca.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\75288df36386c8ce9ad16ff78d6cf3ca.exe"C:\Users\Admin\AppData\Local\Temp\75288df36386c8ce9ad16ff78d6cf3ca.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 15686⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 15642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
75288df36386c8ce9ad16ff78d6cf3ca
SHA13f8553a2bfeac57bb76cb4e2050d3aa7fa0a111a
SHA25686c9b8f7003a77106c1746a855da645783d6ed30fffa45350554ab2edd0e1290
SHA5127701c1630fa0c19afb98321dc9af635e64080dcbefb356f95051165e84dd27405a919a8ae77e5d38a568a7ce24b9977cd61c45920315c82a73b760080704b0f6
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
75288df36386c8ce9ad16ff78d6cf3ca
SHA13f8553a2bfeac57bb76cb4e2050d3aa7fa0a111a
SHA25686c9b8f7003a77106c1746a855da645783d6ed30fffa45350554ab2edd0e1290
SHA5127701c1630fa0c19afb98321dc9af635e64080dcbefb356f95051165e84dd27405a919a8ae77e5d38a568a7ce24b9977cd61c45920315c82a73b760080704b0f6
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
75288df36386c8ce9ad16ff78d6cf3ca
SHA13f8553a2bfeac57bb76cb4e2050d3aa7fa0a111a
SHA25686c9b8f7003a77106c1746a855da645783d6ed30fffa45350554ab2edd0e1290
SHA5127701c1630fa0c19afb98321dc9af635e64080dcbefb356f95051165e84dd27405a919a8ae77e5d38a568a7ce24b9977cd61c45920315c82a73b760080704b0f6
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
75288df36386c8ce9ad16ff78d6cf3ca
SHA13f8553a2bfeac57bb76cb4e2050d3aa7fa0a111a
SHA25686c9b8f7003a77106c1746a855da645783d6ed30fffa45350554ab2edd0e1290
SHA5127701c1630fa0c19afb98321dc9af635e64080dcbefb356f95051165e84dd27405a919a8ae77e5d38a568a7ce24b9977cd61c45920315c82a73b760080704b0f6
-
memory/432-23-0x0000000000000000-mapping.dmp
-
memory/432-26-0x0000000073CE0000-0x00000000743CE000-memory.dmpFilesize
6.9MB
-
memory/560-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/560-15-0x0000000000413FA4-mapping.dmp
-
memory/560-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/788-9-0x0000000000000000-mapping.dmp
-
memory/1324-31-0x0000000000000000-mapping.dmp
-
memory/1596-32-0x0000000000000000-mapping.dmp
-
memory/1748-34-0x0000000000000000-mapping.dmp
-
memory/1816-33-0x0000000000000000-mapping.dmp
-
memory/2112-17-0x0000000000000000-mapping.dmp
-
memory/2196-36-0x0000000000000000-mapping.dmp
-
memory/2356-37-0x0000000000000000-mapping.dmp
-
memory/2836-42-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2836-40-0x0000000000413FA4-mapping.dmp
-
memory/3220-10-0x0000000000000000-mapping.dmp
-
memory/3444-8-0x0000000000000000-mapping.dmp
-
memory/3516-7-0x0000000000000000-mapping.dmp
-
memory/3904-18-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/4060-13-0x0000000000000000-mapping.dmp
-
memory/4208-12-0x0000000000000000-mapping.dmp
-
memory/4448-22-0x0000000000000000-mapping.dmp
-
memory/4588-43-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/4700-2-0x0000000073CE0000-0x00000000743CE000-memory.dmpFilesize
6.9MB
-
memory/4700-6-0x0000000004B20000-0x0000000004B4F000-memory.dmpFilesize
188KB
-
memory/4700-11-0x0000000005D50000-0x0000000005D51000-memory.dmpFilesize
4KB
-
memory/4700-5-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/4700-3-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB