Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 12:24
Static task
static1
Behavioral task
behavioral1
Sample
NEW PURCHASE ORDER LISTED ITEMS.exe
Resource
win7v20210408
General
-
Target
NEW PURCHASE ORDER LISTED ITEMS.exe
-
Size
645KB
-
MD5
5e8ff1a9ec1192bae73ec97729e46d63
-
SHA1
2efd06ad72483238327a9570043159d0ab9ece34
-
SHA256
15acacbd5c928108c9db5e319f23e493f45c3a0c8e8b979f7e760675f916ae2b
-
SHA512
a083c78f12bb5d40c9141d12781d3bf013347d0345307df1d6533753b40dac5f26e8e75610bc5b84821525670af42cc4a2736ba868359548290985593453e146
Malware Config
Extracted
remcos
79.134.225.49:1953
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW PURCHASE ORDER LISTED ITEMS.exedescription pid process target process PID 1628 set thread context of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
NEW PURCHASE ORDER LISTED ITEMS.exepid process 1628 NEW PURCHASE ORDER LISTED ITEMS.exe 1628 NEW PURCHASE ORDER LISTED ITEMS.exe 1628 NEW PURCHASE ORDER LISTED ITEMS.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEW PURCHASE ORDER LISTED ITEMS.exedescription pid process Token: SeDebugPrivilege 1628 NEW PURCHASE ORDER LISTED ITEMS.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 572 vbc.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEW PURCHASE ORDER LISTED ITEMS.exedescription pid process target process PID 1628 wrote to memory of 668 1628 NEW PURCHASE ORDER LISTED ITEMS.exe schtasks.exe PID 1628 wrote to memory of 668 1628 NEW PURCHASE ORDER LISTED ITEMS.exe schtasks.exe PID 1628 wrote to memory of 668 1628 NEW PURCHASE ORDER LISTED ITEMS.exe schtasks.exe PID 1628 wrote to memory of 668 1628 NEW PURCHASE ORDER LISTED ITEMS.exe schtasks.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe PID 1628 wrote to memory of 572 1628 NEW PURCHASE ORDER LISTED ITEMS.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER LISTED ITEMS.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER LISTED ITEMS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GiaNEJvKkikVXu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp11AD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp11AD.tmpMD5
5c7f1a5ffc23dc771ef61581d67b094e
SHA174599c894ae589f8560fe3ad62974d4764c7a9d1
SHA2563cc69e34f4a761ba1aabb692092a22bea43db6ae1ed51fb7c7a2f3fea1685d52
SHA512e358c316403402d3260673056a13ee1daf5430f1b57d80eeef0aeb14095f3019d86efaec885982249f2e9ab9ad03ac0166ea96d2b7170af2ee93f87e30b45702
-
memory/572-65-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/572-66-0x0000000000413FA4-mapping.dmp
-
memory/572-68-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/668-63-0x0000000000000000-mapping.dmp
-
memory/1628-60-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/1628-61-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/1628-62-0x0000000000311000-0x0000000000312000-memory.dmpFilesize
4KB