Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 07:50
Static task
static1
Behavioral task
behavioral1
Sample
Urgent order 1812021-672 Q30721,pdf.exe
Resource
win7v20201028
General
-
Target
Urgent order 1812021-672 Q30721,pdf.exe
-
Size
888KB
-
MD5
5f4f037e04be43a34b342e4e481e1a90
-
SHA1
3fdada0e5c3a0e73f38f5b5bc16c13323ad30ff4
-
SHA256
af5e020c1ac3f3590036495b28ebad3153c66986da343142db222a5df5d42b2d
-
SHA512
172f0130ac9d93ca31ba0af555cf8314d94be50cdba9b4ad0278a1d866d028e84020df95269ad56274621d3671d9871c85d8543d17fa6591694febf417e33a89
Malware Config
Extracted
remcos
goddywin.freedynamicdns.net:2525
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Urgent order 1812021-672 Q30721,pdf.exedescription pid process target process PID 1904 set thread context of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Urgent order 1812021-672 Q30721,pdf.exepid process 1904 Urgent order 1812021-672 Q30721,pdf.exe 1904 Urgent order 1812021-672 Q30721,pdf.exe 1904 Urgent order 1812021-672 Q30721,pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Urgent order 1812021-672 Q30721,pdf.exedescription pid process Token: SeDebugPrivilege 1904 Urgent order 1812021-672 Q30721,pdf.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Urgent order 1812021-672 Q30721,pdf.exedescription pid process target process PID 1904 wrote to memory of 1012 1904 Urgent order 1812021-672 Q30721,pdf.exe schtasks.exe PID 1904 wrote to memory of 1012 1904 Urgent order 1812021-672 Q30721,pdf.exe schtasks.exe PID 1904 wrote to memory of 1012 1904 Urgent order 1812021-672 Q30721,pdf.exe schtasks.exe PID 1904 wrote to memory of 1012 1904 Urgent order 1812021-672 Q30721,pdf.exe schtasks.exe PID 1904 wrote to memory of 1492 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 1492 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 1492 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 1492 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe PID 1904 wrote to memory of 568 1904 Urgent order 1812021-672 Q30721,pdf.exe Urgent order 1812021-672 Q30721,pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yQrHLa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA65D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA65D.tmpMD5
10c915157c4392252917fe4c557bee4e
SHA1805c7319a79f62c3aaac7be22fe92629eacef7cd
SHA2569039fd831864c0c88d1314419d594e28ae809047223f44f7180d328a737f5cb0
SHA51203f18ce2b206da1c3edfc870c14cec9515021c0f8d96d02bbedf9bba79494bf21e9c7b44aab3d039df25b65873ba59a3c019471860028e60b14eddd65c37c9df
-
memory/568-11-0x0000000000413FA4-mapping.dmp
-
memory/568-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/568-12-0x00000000766F1000-0x00000000766F3000-memory.dmpFilesize
8KB
-
memory/568-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1012-8-0x0000000000000000-mapping.dmp
-
memory/1904-2-0x00000000741A0000-0x000000007488E000-memory.dmpFilesize
6.9MB
-
memory/1904-3-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB
-
memory/1904-5-0x00000000047A0000-0x00000000047A1000-memory.dmpFilesize
4KB
-
memory/1904-6-0x0000000000340000-0x000000000034E000-memory.dmpFilesize
56KB
-
memory/1904-7-0x0000000004C00000-0x0000000004C4E000-memory.dmpFilesize
312KB