Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:57
Static task
static1
Behavioral task
behavioral1
Sample
ae8ba034c111e338ffc8cced610e23c7.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ae8ba034c111e338ffc8cced610e23c7.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
ae8ba034c111e338ffc8cced610e23c7.exe
-
Size
724KB
-
MD5
ae8ba034c111e338ffc8cced610e23c7
-
SHA1
edfd786403ebea26e612b0240b1ce980f170f245
-
SHA256
6cdb03bc316fbf184d610d24d85ca86ec2269413ae8ae8ac87f296afb08dacea
-
SHA512
bbae7a78743ded59170bab7fa5a2a240ab24fbe065f39d0c00d13655fefba4074d23e952ca994945a722f24dedee6d59c8d2ca0569f2497a1e3f82b1490c2b42
Score
10/10
Malware Config
Extracted
Family
remcos
C2
4sureme.ddns.net:4902
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ae8ba034c111e338ffc8cced610e23c7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rvchn = "C:\\Users\\Admin\\nhcvR.url" ae8ba034c111e338ffc8cced610e23c7.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ieinstal.exepid process 1056 ieinstal.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ae8ba034c111e338ffc8cced610e23c7.exedescription pid process target process PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe PID 1052 wrote to memory of 1056 1052 ae8ba034c111e338ffc8cced610e23c7.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae8ba034c111e338ffc8cced610e23c7.exe"C:\Users\Admin\AppData\Local\Temp\ae8ba034c111e338ffc8cced610e23c7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-2-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/1056-3-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/1056-4-0x0000000000000000-mapping.dmp
-
memory/1056-5-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/1056-7-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/1056-12-0x0000000010540000-0x0000000010564000-memory.dmpFilesize
144KB
-
memory/1056-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB