Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 20:15
Static task
static1
Behavioral task
behavioral1
Sample
sB2ppXd9nd1DsMC.exe
Resource
win7v20201028
General
-
Target
sB2ppXd9nd1DsMC.exe
-
Size
831KB
-
MD5
6471f431e11c4285b7ba8ac3c3e71ad9
-
SHA1
46f5265999242b24f5ff5cae831709b616a2c381
-
SHA256
b76e862dccd0da9b40dccf294bef402dc7a34185449bf55b022eb79dc8ce6e23
-
SHA512
095f5ed132db126a2f4571d3209fb697a609f75887d2a37a8630d5397f7422288d1903b2f21b62138be8644fe1fe9ca1c0537076a541fa9cecb1cb57779dd5f4
Malware Config
Extracted
remcos
185.244.26.241:1989
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
sB2ppXd9nd1DsMC.exedescription pid process target process PID 2008 set thread context of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
sB2ppXd9nd1DsMC.exedescription pid process target process PID 2008 wrote to memory of 1928 2008 sB2ppXd9nd1DsMC.exe schtasks.exe PID 2008 wrote to memory of 1928 2008 sB2ppXd9nd1DsMC.exe schtasks.exe PID 2008 wrote to memory of 1928 2008 sB2ppXd9nd1DsMC.exe schtasks.exe PID 2008 wrote to memory of 1928 2008 sB2ppXd9nd1DsMC.exe schtasks.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe PID 2008 wrote to memory of 268 2008 sB2ppXd9nd1DsMC.exe sB2ppXd9nd1DsMC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wShTcQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8C0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"C:\Users\Admin\AppData\Local\Temp\sB2ppXd9nd1DsMC.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF8C0.tmpMD5
8d8ac7df42305e6cb4ce97e3b9b635c6
SHA103f652d663b2fa5330b90c4ba27b19ce55d1e50c
SHA256571f2eba729d8670fcc3c2c84b1c1f2b8a375f3fe3e15fa32a5811bfd71d5743
SHA51210ffcdf580af4085b475bd708ec912275aa9eb64ec93a250cb0aa578681257c7aa253ac84793d564d554ae88ea3f4892acaba608a42d51202a5d1f964bead38e
-
memory/268-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/268-11-0x0000000000413FA4-mapping.dmp
-
memory/268-12-0x0000000075EA1000-0x0000000075EA3000-memory.dmpFilesize
8KB
-
memory/268-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-8-0x0000000000000000-mapping.dmp
-
memory/2008-2-0x0000000073AF0000-0x00000000741DE000-memory.dmpFilesize
6.9MB
-
memory/2008-3-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2008-5-0x00000000004C0000-0x00000000004E3000-memory.dmpFilesize
140KB
-
memory/2008-6-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/2008-7-0x0000000004C90000-0x0000000004CE9000-memory.dmpFilesize
356KB