Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-02-2021 03:08
Static task
static1
Behavioral task
behavioral1
Sample
SexOnTheBeach.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
SexOnTheBeach.bin.exe
-
Size
1.2MB
-
MD5
3d0807aa99589883f5dc7cb8fb6490d5
-
SHA1
40e1d6397069aa7a02d04878df48a75ae0031c1f
-
SHA256
cda3c2f396a4e635e9b1021a9bce498172e893e38af0de9790b682d0ca925f63
-
SHA512
fb332eb89421a6925b04565bf22919b0fe73549314dc9855b4119bcf22d594bdd4e4918f4aebdf252c89fb48c3a5e6678d59852b49d3904af67d8557dc01440c
Malware Config
Extracted
Family
remcos
C2
37.252.11.23:7878
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
cmd.exeflow pid Process 17 2852 cmd.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc Process File created C:\Windows\Tasks\ctmon.job cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SexOnTheBeach.bin.exenotepad.exepid Process 500 SexOnTheBeach.bin.exe 1820 notepad.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
notepad.exepid Process 1820 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SexOnTheBeach.bin.exedescription pid Process procid_target PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75 PID 500 wrote to memory of 1820 500 SexOnTheBeach.bin.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\SexOnTheBeach.bin.exe"C:\Users\Admin\AppData\Local\Temp\SexOnTheBeach.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
PID:2852
-
-