Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
19-04-2021 00:06
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza010714008071991847569194350.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Factura Serfinanza010714008071991847569194350.exe
Resource
win10v20210408
General
-
Target
Factura Serfinanza010714008071991847569194350.exe
-
Size
128KB
-
MD5
1a152aa6ddf352230b7351c563d675a3
-
SHA1
517ef6ac130eecc9ea1d0443552fd184187254f3
-
SHA256
6906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b
-
SHA512
1178ed0d9f9f2ce401860723aaa4f21981bd3a6186c0fad482a58c5a63e58b2461e1c0d051d6dd8763c4ed184051e700a755db190e072f06f73ed4c660356c3e
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 2824 PxxoServicesTrialNet1.exe 2060 PxxoServicesTrialNet1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Factura Serfinanza010714008071991847569194350.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" Factura Serfinanza010714008071991847569194350.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exePxxoServicesTrialNet1.exedescription pid process target process PID 856 set thread context of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 2824 set thread context of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings Factura Serfinanza010714008071991847569194350.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exepid process 856 Factura Serfinanza010714008071991847569194350.exe 856 Factura Serfinanza010714008071991847569194350.exe 856 Factura Serfinanza010714008071991847569194350.exe 856 Factura Serfinanza010714008071991847569194350.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exedescription pid process Token: SeDebugPrivilege 856 Factura Serfinanza010714008071991847569194350.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 2060 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
Factura Serfinanza010714008071991847569194350.exeFactura Serfinanza010714008071991847569194350.exeWScript.execmd.exePxxoServicesTrialNet1.exedescription pid process target process PID 856 wrote to memory of 1676 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 1676 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 1676 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 644 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 644 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 644 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 856 wrote to memory of 3684 856 Factura Serfinanza010714008071991847569194350.exe Factura Serfinanza010714008071991847569194350.exe PID 3684 wrote to memory of 3596 3684 Factura Serfinanza010714008071991847569194350.exe WScript.exe PID 3684 wrote to memory of 3596 3684 Factura Serfinanza010714008071991847569194350.exe WScript.exe PID 3684 wrote to memory of 3596 3684 Factura Serfinanza010714008071991847569194350.exe WScript.exe PID 3596 wrote to memory of 2204 3596 WScript.exe cmd.exe PID 3596 wrote to memory of 2204 3596 WScript.exe cmd.exe PID 3596 wrote to memory of 2204 3596 WScript.exe cmd.exe PID 2204 wrote to memory of 2824 2204 cmd.exe PxxoServicesTrialNet1.exe PID 2204 wrote to memory of 2824 2204 cmd.exe PxxoServicesTrialNet1.exe PID 2204 wrote to memory of 2824 2204 cmd.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2824 wrote to memory of 2060 2824 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza010714008071991847569194350.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
1a152aa6ddf352230b7351c563d675a3
SHA1517ef6ac130eecc9ea1d0443552fd184187254f3
SHA2566906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b
SHA5121178ed0d9f9f2ce401860723aaa4f21981bd3a6186c0fad482a58c5a63e58b2461e1c0d051d6dd8763c4ed184051e700a755db190e072f06f73ed4c660356c3e
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
1a152aa6ddf352230b7351c563d675a3
SHA1517ef6ac130eecc9ea1d0443552fd184187254f3
SHA2566906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b
SHA5121178ed0d9f9f2ce401860723aaa4f21981bd3a6186c0fad482a58c5a63e58b2461e1c0d051d6dd8763c4ed184051e700a755db190e072f06f73ed4c660356c3e
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
1a152aa6ddf352230b7351c563d675a3
SHA1517ef6ac130eecc9ea1d0443552fd184187254f3
SHA2566906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b
SHA5121178ed0d9f9f2ce401860723aaa4f21981bd3a6186c0fad482a58c5a63e58b2461e1c0d051d6dd8763c4ed184051e700a755db190e072f06f73ed4c660356c3e
-
C:\Users\Admin\NKvhqsFxQMD5
f761c0dfcfb3499255fd0997e66bb9a9
SHA1e28cad309b4b6df350e66da10820bfe5761d5606
SHA25678e2d014ef05ae8a299baeedbb2a03d406e0500872739ea1514a0e1b84186230
SHA5120b71d81d4afa48209096768980567b76ea544942f1bb366c67b86d76e92998eb9c920a4b1e86b8bd360259aecbdfc43b66fdd731bc8c9d3da04b1ffcae29967f
-
memory/856-119-0x0000000006960000-0x0000000006961000-memory.dmpFilesize
4KB
-
memory/856-118-0x0000000005120000-0x0000000005155000-memory.dmpFilesize
212KB
-
memory/856-116-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/856-114-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/856-117-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/2060-139-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2060-137-0x0000000000413FA4-mapping.dmp
-
memory/2204-125-0x0000000000000000-mapping.dmp
-
memory/2824-135-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/2824-126-0x0000000000000000-mapping.dmp
-
memory/3596-122-0x0000000000000000-mapping.dmp
-
memory/3684-121-0x0000000000413FA4-mapping.dmp
-
memory/3684-124-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3684-120-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB