Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-04-2021 09:05
Static task
static1
Behavioral task
behavioral1
Sample
Dringende Bestellung Zitat CTX88467638,pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Dringende Bestellung Zitat CTX88467638,pdf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Dringende Bestellung Zitat CTX88467638,pdf.exe
-
Size
769KB
-
MD5
66525016cb1f9420e5e5c178082346cf
-
SHA1
afe3c32389f0009959d9de94feb11e2bf1f1abd7
-
SHA256
0f3cac160b09665561487322c11c5ee1ad0eb221b32edfecf1fe01d5b5f278f7
-
SHA512
26eefff0cdc04747ccfb432c0154ec271b2b9ad6ead105fe0f9cd07ba08df05f13d15771eafaeec9912acf02b289ecde134d56c5c398198c9c256b6580058d7c
Score
10/10
Malware Config
Extracted
Family
remcos
C2
ongod4life.ddns.net:4344
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Dringende Bestellung Zitat CTX88467638,pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ntozkw = "C:\\Users\\Public\\Libraries\\wkzotN.url" Dringende Bestellung Zitat CTX88467638,pdf.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Dringende Bestellung Zitat CTX88467638,pdf.exedescription pid process target process PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe PID 4768 wrote to memory of 4424 4768 Dringende Bestellung Zitat CTX88467638,pdf.exe secinit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dringende Bestellung Zitat CTX88467638,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Dringende Bestellung Zitat CTX88467638,pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\Windows\System32\secinit.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4424-119-0x0000000000000000-mapping.dmp
-
memory/4424-121-0x0000000003350000-0x0000000003351000-memory.dmpFilesize
4KB
-
memory/4424-120-0x0000000003290000-0x0000000003291000-memory.dmpFilesize
4KB
-
memory/4424-123-0x00000000032F0000-0x00000000032F1000-memory.dmpFilesize
4KB
-
memory/4424-125-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4424-124-0x0000000010540000-0x0000000010564000-memory.dmpFilesize
144KB
-
memory/4768-114-0x00000000004D0000-0x000000000057E000-memory.dmpFilesize
696KB
-
memory/4768-117-0x0000000000600000-0x000000000061A000-memory.dmpFilesize
104KB