Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
19-04-2021 01:06
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza022880209777477966487010096.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Factura Serfinanza022880209777477966487010096.exe
Resource
win10v20210408
General
-
Target
Factura Serfinanza022880209777477966487010096.exe
-
Size
135KB
-
MD5
8ee3cff17a552175cd7d2bcf92b4bc51
-
SHA1
e4b7f445dd5811f937d4978689f3643113a1dc2f
-
SHA256
7db8c02cc05e287e3d0219807e5e505b44f19180fa6401bc47107e92f36dd3ff
-
SHA512
8a54cee30ce735b08880165be18272f318d6c44c741fa89eee61ef05922ccbcb7f233aa74c9c576a54d5c607a36b74190b8c5c1f794aeb8681bea06caa37357d
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 820 PxxoServicesTrialNet1.exe 972 PxxoServicesTrialNet1.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1560 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Factura Serfinanza022880209777477966487010096.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Factura Serfinanza022880209777477966487010096.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" Factura Serfinanza022880209777477966487010096.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Factura Serfinanza022880209777477966487010096.exePxxoServicesTrialNet1.exedescription pid process target process PID 1688 set thread context of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 820 set thread context of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Factura Serfinanza022880209777477966487010096.exepid process 1688 Factura Serfinanza022880209777477966487010096.exe 1688 Factura Serfinanza022880209777477966487010096.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Factura Serfinanza022880209777477966487010096.exedescription pid process Token: SeDebugPrivilege 1688 Factura Serfinanza022880209777477966487010096.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 972 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
Factura Serfinanza022880209777477966487010096.exeFactura Serfinanza022880209777477966487010096.exeWScript.execmd.exePxxoServicesTrialNet1.exedescription pid process target process PID 1688 wrote to memory of 1296 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1296 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1296 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1296 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1688 wrote to memory of 1100 1688 Factura Serfinanza022880209777477966487010096.exe Factura Serfinanza022880209777477966487010096.exe PID 1100 wrote to memory of 412 1100 Factura Serfinanza022880209777477966487010096.exe WScript.exe PID 1100 wrote to memory of 412 1100 Factura Serfinanza022880209777477966487010096.exe WScript.exe PID 1100 wrote to memory of 412 1100 Factura Serfinanza022880209777477966487010096.exe WScript.exe PID 1100 wrote to memory of 412 1100 Factura Serfinanza022880209777477966487010096.exe WScript.exe PID 412 wrote to memory of 1560 412 WScript.exe cmd.exe PID 412 wrote to memory of 1560 412 WScript.exe cmd.exe PID 412 wrote to memory of 1560 412 WScript.exe cmd.exe PID 412 wrote to memory of 1560 412 WScript.exe cmd.exe PID 1560 wrote to memory of 820 1560 cmd.exe PxxoServicesTrialNet1.exe PID 1560 wrote to memory of 820 1560 cmd.exe PxxoServicesTrialNet1.exe PID 1560 wrote to memory of 820 1560 cmd.exe PxxoServicesTrialNet1.exe PID 1560 wrote to memory of 820 1560 cmd.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 820 wrote to memory of 972 820 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza022880209777477966487010096.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza022880209777477966487010096.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza022880209777477966487010096.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza022880209777477966487010096.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza022880209777477966487010096.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza022880209777477966487010096.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8ee3cff17a552175cd7d2bcf92b4bc51
SHA1e4b7f445dd5811f937d4978689f3643113a1dc2f
SHA2567db8c02cc05e287e3d0219807e5e505b44f19180fa6401bc47107e92f36dd3ff
SHA5128a54cee30ce735b08880165be18272f318d6c44c741fa89eee61ef05922ccbcb7f233aa74c9c576a54d5c607a36b74190b8c5c1f794aeb8681bea06caa37357d
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8ee3cff17a552175cd7d2bcf92b4bc51
SHA1e4b7f445dd5811f937d4978689f3643113a1dc2f
SHA2567db8c02cc05e287e3d0219807e5e505b44f19180fa6401bc47107e92f36dd3ff
SHA5128a54cee30ce735b08880165be18272f318d6c44c741fa89eee61ef05922ccbcb7f233aa74c9c576a54d5c607a36b74190b8c5c1f794aeb8681bea06caa37357d
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8ee3cff17a552175cd7d2bcf92b4bc51
SHA1e4b7f445dd5811f937d4978689f3643113a1dc2f
SHA2567db8c02cc05e287e3d0219807e5e505b44f19180fa6401bc47107e92f36dd3ff
SHA5128a54cee30ce735b08880165be18272f318d6c44c741fa89eee61ef05922ccbcb7f233aa74c9c576a54d5c607a36b74190b8c5c1f794aeb8681bea06caa37357d
-
C:\Users\Admin\OPqcbCYdOIAqUQbOxTABjHSzEzXMD5
c219b922aa15dde208d2929c49226b08
SHA13647086fe46c7c328d53ecff8811311944d762b1
SHA256b0d33778a580f0f2469db5f263a9a87b0f2bfb0c300f774e7752d6facc06ba56
SHA5122e3412fab760b53c926b3a934fab15201b9a9043fb238859e66ebeff94edf38e5386e5ec70c55b0171e648deb40c2866854dde42e95035541349a5722a6c36be
-
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8ee3cff17a552175cd7d2bcf92b4bc51
SHA1e4b7f445dd5811f937d4978689f3643113a1dc2f
SHA2567db8c02cc05e287e3d0219807e5e505b44f19180fa6401bc47107e92f36dd3ff
SHA5128a54cee30ce735b08880165be18272f318d6c44c741fa89eee61ef05922ccbcb7f233aa74c9c576a54d5c607a36b74190b8c5c1f794aeb8681bea06caa37357d
-
memory/412-69-0x0000000000000000-mapping.dmp
-
memory/820-82-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/820-75-0x0000000000000000-mapping.dmp
-
memory/820-77-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/972-87-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/972-84-0x0000000000413FA4-mapping.dmp
-
memory/1100-66-0x0000000000413FA4-mapping.dmp
-
memory/1100-68-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1100-65-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1560-72-0x0000000000000000-mapping.dmp
-
memory/1688-63-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/1688-64-0x00000000008E0000-0x000000000090C000-memory.dmpFilesize
176KB
-
memory/1688-62-0x0000000075011000-0x0000000075013000-memory.dmpFilesize
8KB
-
memory/1688-60-0x0000000001250000-0x0000000001251000-memory.dmpFilesize
4KB