Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
19-04-2021 00:06
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza010714008071991847569194350.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Factura Serfinanza010714008071991847569194350.exe
Resource
win10v20210408
General
-
Target
Factura Serfinanza010714008071991847569194350.exe
-
Size
128KB
-
MD5
1a152aa6ddf352230b7351c563d675a3
-
SHA1
517ef6ac130eecc9ea1d0443552fd184187254f3
-
SHA256
6906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b
-
SHA512
1178ed0d9f9f2ce401860723aaa4f21981bd3a6186c0fad482a58c5a63e58b2461e1c0d051d6dd8763c4ed184051e700a755db190e072f06f73ed4c660356c3e
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 276 PxxoServicesTrialNet1.exe 1316 PxxoServicesTrialNet1.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1012 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Factura Serfinanza010714008071991847569194350.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" Factura Serfinanza010714008071991847569194350.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exePxxoServicesTrialNet1.exedescription pid process target process PID 1652 set thread context of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 276 set thread context of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exedescription pid process Token: SeDebugPrivilege 1652 Factura Serfinanza010714008071991847569194350.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 1316 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exeFactura Serfinanza010714008071991847569194350.exeWScript.execmd.exePxxoServicesTrialNet1.exedescription pid process target process PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 1652 wrote to memory of 792 1652 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 792 wrote to memory of 916 792 Factura Serfinanza010714008071991847569194350.exe WScript.exe PID 792 wrote to memory of 916 792 Factura Serfinanza010714008071991847569194350.exe WScript.exe PID 792 wrote to memory of 916 792 Factura Serfinanza010714008071991847569194350.exe WScript.exe PID 792 wrote to memory of 916 792 Factura Serfinanza010714008071991847569194350.exe WScript.exe PID 916 wrote to memory of 1012 916 WScript.exe cmd.exe PID 916 wrote to memory of 1012 916 WScript.exe cmd.exe PID 916 wrote to memory of 1012 916 WScript.exe cmd.exe PID 916 wrote to memory of 1012 916 WScript.exe cmd.exe PID 1012 wrote to memory of 276 1012 cmd.exe PxxoServicesTrialNet1.exe PID 1012 wrote to memory of 276 1012 cmd.exe PxxoServicesTrialNet1.exe PID 1012 wrote to memory of 276 1012 cmd.exe PxxoServicesTrialNet1.exe PID 1012 wrote to memory of 276 1012 cmd.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 276 wrote to memory of 1316 276 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
1a152aa6ddf352230b7351c563d675a3
SHA1517ef6ac130eecc9ea1d0443552fd184187254f3
SHA2566906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b
SHA5121178ed0d9f9f2ce401860723aaa4f21981bd3a6186c0fad482a58c5a63e58b2461e1c0d051d6dd8763c4ed184051e700a755db190e072f06f73ed4c660356c3e
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
1a152aa6ddf352230b7351c563d675a3
SHA1517ef6ac130eecc9ea1d0443552fd184187254f3
SHA2566906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b
SHA5121178ed0d9f9f2ce401860723aaa4f21981bd3a6186c0fad482a58c5a63e58b2461e1c0d051d6dd8763c4ed184051e700a755db190e072f06f73ed4c660356c3e
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
1a152aa6ddf352230b7351c563d675a3
SHA1517ef6ac130eecc9ea1d0443552fd184187254f3
SHA2566906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b
SHA5121178ed0d9f9f2ce401860723aaa4f21981bd3a6186c0fad482a58c5a63e58b2461e1c0d051d6dd8763c4ed184051e700a755db190e072f06f73ed4c660356c3e
-
C:\Users\Admin\NKvhqsFxQMD5
f761c0dfcfb3499255fd0997e66bb9a9
SHA1e28cad309b4b6df350e66da10820bfe5761d5606
SHA25678e2d014ef05ae8a299baeedbb2a03d406e0500872739ea1514a0e1b84186230
SHA5120b71d81d4afa48209096768980567b76ea544942f1bb366c67b86d76e92998eb9c920a4b1e86b8bd360259aecbdfc43b66fdd731bc8c9d3da04b1ffcae29967f
-
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
1a152aa6ddf352230b7351c563d675a3
SHA1517ef6ac130eecc9ea1d0443552fd184187254f3
SHA2566906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b
SHA5121178ed0d9f9f2ce401860723aaa4f21981bd3a6186c0fad482a58c5a63e58b2461e1c0d051d6dd8763c4ed184051e700a755db190e072f06f73ed4c660356c3e
-
memory/276-82-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/276-75-0x0000000000000000-mapping.dmp
-
memory/276-77-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/792-66-0x0000000000413FA4-mapping.dmp
-
memory/792-65-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/792-68-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/916-69-0x0000000000000000-mapping.dmp
-
memory/1012-72-0x0000000000000000-mapping.dmp
-
memory/1316-87-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1316-84-0x0000000000413FA4-mapping.dmp
-
memory/1652-64-0x0000000001FE0000-0x0000000002015000-memory.dmpFilesize
212KB
-
memory/1652-63-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/1652-62-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/1652-60-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB