Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 20:15
Static task
static1
Behavioral task
behavioral1
Sample
sB2ppXd9nd1DsMC.exe
Resource
win7v20201028
General
-
Target
sB2ppXd9nd1DsMC.exe
-
Size
831KB
-
MD5
6471f431e11c4285b7ba8ac3c3e71ad9
-
SHA1
46f5265999242b24f5ff5cae831709b616a2c381
-
SHA256
b76e862dccd0da9b40dccf294bef402dc7a34185449bf55b022eb79dc8ce6e23
-
SHA512
095f5ed132db126a2f4571d3209fb697a609f75887d2a37a8630d5397f7422288d1903b2f21b62138be8644fe1fe9ca1c0537076a541fa9cecb1cb57779dd5f4
Malware Config
Extracted
remcos
185.244.26.241:1989
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
sB2ppXd9nd1DsMC.exedescription pid process target process PID 636 set thread context of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
sB2ppXd9nd1DsMC.exepid process 636 sB2ppXd9nd1DsMC.exe 636 sB2ppXd9nd1DsMC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sB2ppXd9nd1DsMC.exedescription pid process Token: SeDebugPrivilege 636 sB2ppXd9nd1DsMC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
sB2ppXd9nd1DsMC.exedescription pid process target process PID 636 wrote to memory of 684 636 sB2ppXd9nd1DsMC.exe schtasks.exe PID 636 wrote to memory of 684 636 sB2ppXd9nd1DsMC.exe schtasks.exe PID 636 wrote to memory of 684 636 sB2ppXd9nd1DsMC.exe schtasks.exe PID 636 wrote to memory of 3228 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 3228 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 3228 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 636 wrote to memory of 744 636 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wShTcQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp51E9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp51E9.tmpMD5
1f5479b7005731bfda18fcecc1855a9e
SHA1c78fb8d3537ae4ce1954bf48fc23b75fb4d9f0f3
SHA25620ea43de452767b74bfd7e990218c6a4c48333242996a6f992cc7e32b99303c7
SHA5126bf56d37072209f8398b26a42fbd6b5291288ef41790294b46d52ffdce383646565802af69100faaf34e0c731d0e5b5b56caf006a68351813cebf7d2998eee79
-
memory/636-9-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/636-11-0x00000000053D0000-0x00000000053F3000-memory.dmpFilesize
140KB
-
memory/636-6-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/636-7-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/636-8-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/636-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/636-10-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/636-5-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/636-12-0x0000000005F80000-0x0000000005FD9000-memory.dmpFilesize
356KB
-
memory/636-3-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB
-
memory/684-13-0x0000000000000000-mapping.dmp
-
memory/744-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/744-16-0x0000000000413FA4-mapping.dmp
-
memory/744-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB