Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
06/04/2021, 15:25
Static task
static1
Behavioral task
behavioral1
Sample
1524892380fe641d3bce387e17892c0f.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 1524892380fe641d3bce387e17892c0f.exe
- Size 1012KB
- Sample210406-khvhmh2gm2
- SHA256 63df29d3fa84705de35251b66c3cf555ba225d9a2b064edbd566ccd1b3c59e07
- MD5 1524892380fe641d3bce387e17892c0f
- SHA1 2ec5449079f5f9899f7b3ee0cb26217ca01695a6
- SHA512 bca18cbcf29af2e5c323bcf33e87e8df8e8033449f59c7fa0ef796911ac522a757c1344b7c0564c0648e26cc065d3dc6d7d6dbd01e13354c2d410028e0f33cda
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
remcos
C2
-
cato.fingusti.club:6609
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2496 xxxht.pif - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run xxxht.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\70310558\\xxxht.pif C:\\Users\\Admin\\AppData\\Roaming\\70310558\\VTMKNO~1.MEU" xxxht.pif - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2496 set thread context of 4432 2496 xxxht.pif 77 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif 2496 xxxht.pif - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4432 RegSvcs.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4432 RegSvcs.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4776 wrote to memory of 2496 4776 1524892380fe641d3bce387e17892c0f.exe 75 PID 4776 wrote to memory of 2496 4776 1524892380fe641d3bce387e17892c0f.exe 75 PID 4776 wrote to memory of 2496 4776 1524892380fe641d3bce387e17892c0f.exe 75 PID 2496 wrote to memory of 4432 2496 xxxht.pif 77 PID 2496 wrote to memory of 4432 2496 xxxht.pif 77 PID 2496 wrote to memory of 4432 2496 xxxht.pif 77 PID 2496 wrote to memory of 4432 2496 xxxht.pif 77 PID 2496 wrote to memory of 4432 2496 xxxht.pif 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\1524892380fe641d3bce387e17892c0f.exe"C:\Users\Admin\AppData\Local\Temp\1524892380fe641d3bce387e17892c0f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Roaming\70310558\xxxht.pif"C:\Users\Admin\AppData\Roaming\70310558\xxxht.pif" vtmknoigqt.meu2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4432
-
-