Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-01-2021 14:46
Static task
static1
Behavioral task
behavioral1
Sample
richiealvin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
richiealvin.exe
Resource
win10v20201028
General
-
Target
richiealvin.exe
-
Size
791KB
-
MD5
57cbb0c81ccbd1c74fa39bd6d1d32884
-
SHA1
bbb48a60aa774829cd22d86dfe0530fb79b35b83
-
SHA256
46336468a43514fedfce240a5a3ca440c938d465c59fba6ce8d3b9383c5521cd
-
SHA512
aef00ecb214cde6efd34664494421c9724b7c8d77a55a33f0a043245cefa3c290d032a930f9e175d2d3d47f9dd5a3665002cd208f6474c63c938551351ada1ff
Malware Config
Extracted
remcos
91.193.75.185:1989
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
system32.exesystem32.exepid process 2684 system32.exe 1436 system32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
richiealvin.exesystem32.exedescription pid process target process PID 4092 set thread context of 564 4092 richiealvin.exe richiealvin.exe PID 2684 set thread context of 1436 2684 system32.exe system32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3212 schtasks.exe 2932 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
richiealvin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings richiealvin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
richiealvin.exesystem32.exepid process 4092 richiealvin.exe 2684 system32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
richiealvin.exesystem32.exedescription pid process Token: SeDebugPrivilege 4092 richiealvin.exe Token: SeDebugPrivilege 2684 system32.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
richiealvin.exerichiealvin.exeWScript.execmd.exesystem32.exesystem32.exedescription pid process target process PID 4092 wrote to memory of 3212 4092 richiealvin.exe schtasks.exe PID 4092 wrote to memory of 3212 4092 richiealvin.exe schtasks.exe PID 4092 wrote to memory of 3212 4092 richiealvin.exe schtasks.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 4092 wrote to memory of 564 4092 richiealvin.exe richiealvin.exe PID 564 wrote to memory of 864 564 richiealvin.exe WScript.exe PID 564 wrote to memory of 864 564 richiealvin.exe WScript.exe PID 564 wrote to memory of 864 564 richiealvin.exe WScript.exe PID 864 wrote to memory of 416 864 WScript.exe cmd.exe PID 864 wrote to memory of 416 864 WScript.exe cmd.exe PID 864 wrote to memory of 416 864 WScript.exe cmd.exe PID 416 wrote to memory of 2684 416 cmd.exe system32.exe PID 416 wrote to memory of 2684 416 cmd.exe system32.exe PID 416 wrote to memory of 2684 416 cmd.exe system32.exe PID 2684 wrote to memory of 2932 2684 system32.exe schtasks.exe PID 2684 wrote to memory of 2932 2684 system32.exe schtasks.exe PID 2684 wrote to memory of 2932 2684 system32.exe schtasks.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 2684 wrote to memory of 1436 2684 system32.exe system32.exe PID 1436 wrote to memory of 3976 1436 system32.exe svchost.exe PID 1436 wrote to memory of 3976 1436 system32.exe svchost.exe PID 1436 wrote to memory of 3976 1436 system32.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\richiealvin.exe"C:\Users\Admin\AppData\Local\Temp\richiealvin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTZWsOJmyD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp14B2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\richiealvin.exe"C:\Users\Admin\AppData\Local\Temp\richiealvin.exe"2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Programs\system32.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Programs\system32.exeC:\Users\Admin\AppData\Roaming\Programs\system32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FTZWsOJmyD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF3E6.tmp"6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Programs\system32.exe"C:\Users\Admin\AppData\Roaming\Programs\system32.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
139d1ffe3f418f4794b6359f239089a2
SHA1579f8d9c97105a2a77566de7e802a26e4a27f4c8
SHA2567c71958fda4cff7e2ae1d9309cd4c0143057ca52732926f640252fd5a7a9a2ca
SHA5125b806812558c28ea195326cfe800a2a41377d5e1da1fb352c2aa3d5060237a5ba544dec6f52459a9ecf55b526280c7d9c6aa8a1b8544124b288a4235eb25c2d9
-
C:\Users\Admin\AppData\Local\Temp\tmp14B2.tmpMD5
320b729a8ca1092f36a7438a5659fab4
SHA12b4f68a8f3bc40aacdffab8a62fae1ce301700a3
SHA25679c611df1eb6d4da52290b41b21135dded53b281124acc5e9abe4058ce345074
SHA51299094cc470428eee88535c5839caad11d6d8266d9ea191839ffcc47b2f95c633de6daf405a99416c9373d15b3792b13dbf417f71250ad4990b34b6a2eadb6f90
-
C:\Users\Admin\AppData\Local\Temp\tmpF3E6.tmpMD5
320b729a8ca1092f36a7438a5659fab4
SHA12b4f68a8f3bc40aacdffab8a62fae1ce301700a3
SHA25679c611df1eb6d4da52290b41b21135dded53b281124acc5e9abe4058ce345074
SHA51299094cc470428eee88535c5839caad11d6d8266d9ea191839ffcc47b2f95c633de6daf405a99416c9373d15b3792b13dbf417f71250ad4990b34b6a2eadb6f90
-
C:\Users\Admin\AppData\Roaming\Programs\system32.exeMD5
57cbb0c81ccbd1c74fa39bd6d1d32884
SHA1bbb48a60aa774829cd22d86dfe0530fb79b35b83
SHA25646336468a43514fedfce240a5a3ca440c938d465c59fba6ce8d3b9383c5521cd
SHA512aef00ecb214cde6efd34664494421c9724b7c8d77a55a33f0a043245cefa3c290d032a930f9e175d2d3d47f9dd5a3665002cd208f6474c63c938551351ada1ff
-
C:\Users\Admin\AppData\Roaming\Programs\system32.exeMD5
57cbb0c81ccbd1c74fa39bd6d1d32884
SHA1bbb48a60aa774829cd22d86dfe0530fb79b35b83
SHA25646336468a43514fedfce240a5a3ca440c938d465c59fba6ce8d3b9383c5521cd
SHA512aef00ecb214cde6efd34664494421c9724b7c8d77a55a33f0a043245cefa3c290d032a930f9e175d2d3d47f9dd5a3665002cd208f6474c63c938551351ada1ff
-
C:\Users\Admin\AppData\Roaming\Programs\system32.exeMD5
57cbb0c81ccbd1c74fa39bd6d1d32884
SHA1bbb48a60aa774829cd22d86dfe0530fb79b35b83
SHA25646336468a43514fedfce240a5a3ca440c938d465c59fba6ce8d3b9383c5521cd
SHA512aef00ecb214cde6efd34664494421c9724b7c8d77a55a33f0a043245cefa3c290d032a930f9e175d2d3d47f9dd5a3665002cd208f6474c63c938551351ada1ff
-
memory/416-19-0x0000000000000000-mapping.dmp
-
memory/564-15-0x0000000000413FA4-mapping.dmp
-
memory/564-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/564-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/864-16-0x0000000000000000-mapping.dmp
-
memory/1436-38-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1436-36-0x0000000000413FA4-mapping.dmp
-
memory/2684-23-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/2684-31-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/2684-20-0x0000000000000000-mapping.dmp
-
memory/2932-33-0x0000000000000000-mapping.dmp
-
memory/3212-12-0x0000000000000000-mapping.dmp
-
memory/4092-2-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/4092-6-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/4092-7-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/4092-8-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/4092-9-0x0000000005640000-0x0000000005663000-memory.dmpFilesize
140KB
-
memory/4092-5-0x0000000005B90000-0x0000000005B91000-memory.dmpFilesize
4KB
-
memory/4092-11-0x0000000006360000-0x00000000063B9000-memory.dmpFilesize
356KB
-
memory/4092-3-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/4092-10-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB