Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-04-2021 19:49
Static task
static1
Behavioral task
behavioral1
Sample
Scan_Documents-001HD4847DHD346G.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Scan_Documents-001HD4847DHD346G.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
Scan_Documents-001HD4847DHD346G.exe
-
Size
838KB
-
MD5
303c5d6aa71eede673d90225146fba07
-
SHA1
61e24b0ec1a6933259565c21788e0ccbacd4c630
-
SHA256
6018d6795b86aef8d39205698ca166c8c5d413d06a8a1fa346741bd56ff0e307
-
SHA512
bc584d8b598bf59e4ec1a3b494556df46730fdf31175ac6fdfd4fe8c72781e539d9d082998d7df0b292a3c4212ab16a46a4e734a28b2d0291a016e3bdebd728a
Score
10/10
Malware Config
Extracted
Family
remcos
C2
www.swqrn.com:16108
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Scan_Documents-001HD4847DHD346G.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wfwilj = "C:\\Users\\Public\\Libraries\\jliwfW.url" Scan_Documents-001HD4847DHD346G.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Scan_Documents-001HD4847DHD346G.exedescription ioc process File opened (read-only) \??\V: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\Z: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\H: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\J: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\K: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\R: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\T: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\U: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\S: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\X: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\A: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\E: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\M: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\N: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\O: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\P: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\F: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\L: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\Q: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\Y: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\B: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\G: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\I: Scan_Documents-001HD4847DHD346G.exe File opened (read-only) \??\W: Scan_Documents-001HD4847DHD346G.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Scan_Documents-001HD4847DHD346G.exedescription pid process target process PID 3952 set thread context of 2004 3952 Scan_Documents-001HD4847DHD346G.exe Scan_Documents-001HD4847DHD346G.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Scan_Documents-001HD4847DHD346G.exepid process 2004 Scan_Documents-001HD4847DHD346G.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Scan_Documents-001HD4847DHD346G.exedescription pid process target process PID 3952 wrote to memory of 2004 3952 Scan_Documents-001HD4847DHD346G.exe Scan_Documents-001HD4847DHD346G.exe PID 3952 wrote to memory of 2004 3952 Scan_Documents-001HD4847DHD346G.exe Scan_Documents-001HD4847DHD346G.exe PID 3952 wrote to memory of 2004 3952 Scan_Documents-001HD4847DHD346G.exe Scan_Documents-001HD4847DHD346G.exe PID 3952 wrote to memory of 2004 3952 Scan_Documents-001HD4847DHD346G.exe Scan_Documents-001HD4847DHD346G.exe PID 3952 wrote to memory of 2004 3952 Scan_Documents-001HD4847DHD346G.exe Scan_Documents-001HD4847DHD346G.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan_Documents-001HD4847DHD346G.exe"C:\Users\Admin\AppData\Local\Temp\Scan_Documents-001HD4847DHD346G.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan_Documents-001HD4847DHD346G.exeC:\Users\Admin\AppData\Local\Temp\Scan_Documents-001HD4847DHD346G.exe2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2004-119-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2004-120-0x000000000042F08F-mapping.dmp
-
memory/2004-121-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3952-114-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3952-116-0x0000000002560000-0x000000000257A000-memory.dmpFilesize
104KB