Analysis
-
max time kernel
38s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 07:17
Static task
static1
Behavioral task
behavioral1
Sample
PO-scandocumentsfile00108392.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PO-scandocumentsfile00108392.exe
Resource
win10v20201028
General
-
Target
PO-scandocumentsfile00108392.exe
-
Size
851KB
-
MD5
ed01719e79f8008d4ede16e7edff753a
-
SHA1
9929ccd810f335d2d2b84e7ba519940bb9f58fe8
-
SHA256
a7ada9eefa9c775d0215af6bc497e305f8067290f5e9642e582c6d4c3ec65756
-
SHA512
188adc96dbef43ddc4f110958bf68920288a0b9759317a473e78e146bd302ace63de73da93ec9e644e3526ed9d69472a47ac178e6e3d84ea93ccf21a5a3fab90
Malware Config
Extracted
remcos
www.maneediem.com:2404
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
owerrinta.exepid process 572 owerrinta.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1008 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\owerrita = "\"C:\\Users\\Admin\\AppData\\Roaming\\owerri\\owerrinta.exe\"" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO-scandocumentsfile00108392.exedescription pid process target process PID 292 set thread context of 896 292 PO-scandocumentsfile00108392.exe vbc.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
PO-scandocumentsfile00108392.exevbc.exeWScript.execmd.exedescription pid process target process PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 292 wrote to memory of 896 292 PO-scandocumentsfile00108392.exe vbc.exe PID 896 wrote to memory of 284 896 vbc.exe WScript.exe PID 896 wrote to memory of 284 896 vbc.exe WScript.exe PID 896 wrote to memory of 284 896 vbc.exe WScript.exe PID 896 wrote to memory of 284 896 vbc.exe WScript.exe PID 284 wrote to memory of 1008 284 WScript.exe cmd.exe PID 284 wrote to memory of 1008 284 WScript.exe cmd.exe PID 284 wrote to memory of 1008 284 WScript.exe cmd.exe PID 284 wrote to memory of 1008 284 WScript.exe cmd.exe PID 1008 wrote to memory of 572 1008 cmd.exe owerrinta.exe PID 1008 wrote to memory of 572 1008 cmd.exe owerrinta.exe PID 1008 wrote to memory of 572 1008 cmd.exe owerrinta.exe PID 1008 wrote to memory of 572 1008 cmd.exe owerrinta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-scandocumentsfile00108392.exe"C:\Users\Admin\AppData\Local\Temp\PO-scandocumentsfile00108392.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\owerri\owerrinta.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\owerri\owerrinta.exeC:\Users\Admin\AppData\Roaming\owerri\owerrinta.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
79f2f9da0b9014aaa835d1486a0a6135
SHA1ffe17bfd9b43abf97d526ee85970b370d60eef0b
SHA256d7e5cbc45f2651767966aff75220c6c9094ecaf7a04d978f021087fd03f5d428
SHA5127b05babc0fb5f931c8f889491c05b44684bc851998b93163ea2698e20a6ad9871afc9cf3ff424d7c9edd8f7dc05e1929e2f65593ca927a1574319df96051ebb8
-
C:\Users\Admin\AppData\Roaming\owerri\owerrinta.exeMD5
1f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
C:\Users\Admin\AppData\Roaming\owerri\owerrinta.exeMD5
1f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
\Users\Admin\AppData\Roaming\owerri\owerrinta.exeMD5
1f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
memory/284-10-0x0000000000000000-mapping.dmp
-
memory/284-13-0x00000000025F0000-0x00000000025F4000-memory.dmpFilesize
16KB
-
memory/292-3-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/292-5-0x0000000000320000-0x000000000032E000-memory.dmpFilesize
56KB
-
memory/292-6-0x0000000004950000-0x000000000498E000-memory.dmpFilesize
248KB
-
memory/292-2-0x00000000748A0000-0x0000000074F8E000-memory.dmpFilesize
6.9MB
-
memory/572-16-0x0000000000000000-mapping.dmp
-
memory/896-9-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/896-8-0x0000000000413FA4-mapping.dmp
-
memory/896-7-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1008-12-0x0000000000000000-mapping.dmp