Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
15/01/2021, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe
- Size 1.3MB
- Sample210115-rclnyws69e
- SHA256 f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
- MD5 8a16967ee620b6d50578ec90143e9b88
- SHA1 8b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
- SHA512 f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
wedsazxcvfghyuiokjhbnvfcdsaweyplmhbvrtud.ydns.eu:1996
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2012 win.exe 2508 win.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\"" SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ win.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\"" win.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
pid Process 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 2012 win.exe 2012 win.exe 2012 win.exe 2012 win.exe 2012 win.exe 2012 win.exe 2012 win.exe 2012 win.exe 2012 win.exe 2012 win.exe 2012 win.exe 2012 win.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 508 set thread context of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 2012 set thread context of 2508 2012 win.exe 105 - Program crash 2 IoCs
pid pid_target Process procid_target 648 508 WerFault.exe 67 3452 2012 WerFault.exe 94 - Delays execution with timeout.exe 6 IoCs
pid Process 4012 timeout.exe 3808 timeout.exe 2896 timeout.exe 1232 timeout.exe 724 timeout.exe 2824 timeout.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 648 WerFault.exe 2012 win.exe 2012 win.exe 2012 win.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe 3452 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2508 win.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe Token: SeRestorePrivilege 648 WerFault.exe Token: SeBackupPrivilege 648 WerFault.exe Token: SeDebugPrivilege 648 WerFault.exe Token: SeDebugPrivilege 2012 win.exe Token: SeDebugPrivilege 3452 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2508 win.exe - Suspicious use of WriteProcessMemory 71 IoCs
description pid Process procid_target PID 508 wrote to memory of 3556 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 75 PID 508 wrote to memory of 3556 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 75 PID 508 wrote to memory of 3556 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 75 PID 3556 wrote to memory of 2824 3556 cmd.exe 77 PID 3556 wrote to memory of 2824 3556 cmd.exe 77 PID 3556 wrote to memory of 2824 3556 cmd.exe 77 PID 508 wrote to memory of 2608 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 78 PID 508 wrote to memory of 2608 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 78 PID 508 wrote to memory of 2608 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 78 PID 2608 wrote to memory of 4012 2608 cmd.exe 80 PID 2608 wrote to memory of 4012 2608 cmd.exe 80 PID 2608 wrote to memory of 4012 2608 cmd.exe 80 PID 508 wrote to memory of 1836 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 81 PID 508 wrote to memory of 1836 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 81 PID 508 wrote to memory of 1836 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 81 PID 1836 wrote to memory of 3808 1836 cmd.exe 83 PID 1836 wrote to memory of 3808 1836 cmd.exe 83 PID 1836 wrote to memory of 3808 1836 cmd.exe 83 PID 508 wrote to memory of 1172 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 86 PID 508 wrote to memory of 1172 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 86 PID 508 wrote to memory of 1172 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 86 PID 508 wrote to memory of 1312 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 87 PID 508 wrote to memory of 1312 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 87 PID 508 wrote to memory of 1312 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 87 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 508 wrote to memory of 1168 508 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 88 PID 1168 wrote to memory of 2336 1168 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 90 PID 1168 wrote to memory of 2336 1168 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 90 PID 1168 wrote to memory of 2336 1168 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 90 PID 2336 wrote to memory of 3120 2336 WScript.exe 92 PID 2336 wrote to memory of 3120 2336 WScript.exe 92 PID 2336 wrote to memory of 3120 2336 WScript.exe 92 PID 3120 wrote to memory of 2012 3120 cmd.exe 94 PID 3120 wrote to memory of 2012 3120 cmd.exe 94 PID 3120 wrote to memory of 2012 3120 cmd.exe 94 PID 2012 wrote to memory of 60 2012 win.exe 95 PID 2012 wrote to memory of 60 2012 win.exe 95 PID 2012 wrote to memory of 60 2012 win.exe 95 PID 60 wrote to memory of 2896 60 cmd.exe 97 PID 60 wrote to memory of 2896 60 cmd.exe 97 PID 60 wrote to memory of 2896 60 cmd.exe 97 PID 2012 wrote to memory of 3904 2012 win.exe 98 PID 2012 wrote to memory of 3904 2012 win.exe 98 PID 2012 wrote to memory of 3904 2012 win.exe 98 PID 3904 wrote to memory of 1232 3904 cmd.exe 100 PID 3904 wrote to memory of 1232 3904 cmd.exe 100 PID 3904 wrote to memory of 1232 3904 cmd.exe 100 PID 2012 wrote to memory of 3772 2012 win.exe 102 PID 2012 wrote to memory of 3772 2012 win.exe 102 PID 2012 wrote to memory of 3772 2012 win.exe 102 PID 3772 wrote to memory of 724 3772 cmd.exe 104 PID 3772 wrote to memory of 724 3772 cmd.exe 104 PID 3772 wrote to memory of 724 3772 cmd.exe 104 PID 2012 wrote to memory of 2508 2012 win.exe 105 PID 2012 wrote to memory of 2508 2012 win.exe 105 PID 2012 wrote to memory of 2508 2012 win.exe 105 PID 2012 wrote to memory of 2508 2012 win.exe 105 PID 2012 wrote to memory of 2508 2012 win.exe 105 PID 2012 wrote to memory of 2508 2012 win.exe 105 PID 2012 wrote to memory of 2508 2012 win.exe 105 PID 2012 wrote to memory of 2508 2012 win.exe 105 PID 2012 wrote to memory of 2508 2012 win.exe 105 PID 2012 wrote to memory of 2508 2012 win.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2824
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4012
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3808
-
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"2⤵PID:1172
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"2⤵PID:1312
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\win.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Roaming\win.exeC:\Users\Admin\AppData\Roaming\win.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
PID:1232
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
PID:724
-
-
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 15526⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 15282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648
-