Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-04-2021 06:03
Static task
static1
Behavioral task
behavioral1
Sample
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
Resource
win10v20210410
General
-
Target
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
-
Size
186KB
-
MD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
-
SHA1
b0f907aa92d5b35b5b5fcad992f504525d04a87f
-
SHA256
5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
-
SHA512
1762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 3128 PxxoServicesTrialNet1.exe 3340 PxxoServicesTrialNet1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
PxxoServicesTrialNet1.exeEXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exePxxoServicesTrialNet1.exedescription pid process target process PID 3152 set thread context of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3128 set thread context of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exedescription pid process Token: SeDebugPrivilege 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 3340 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exeEXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exeWScript.execmd.exePxxoServicesTrialNet1.exedescription pid process target process PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3152 wrote to memory of 2780 3152 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 2780 wrote to memory of 3516 2780 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 2780 wrote to memory of 3516 2780 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 2780 wrote to memory of 3516 2780 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 3516 wrote to memory of 3972 3516 WScript.exe cmd.exe PID 3516 wrote to memory of 3972 3516 WScript.exe cmd.exe PID 3516 wrote to memory of 3972 3516 WScript.exe cmd.exe PID 3972 wrote to memory of 3128 3972 cmd.exe PxxoServicesTrialNet1.exe PID 3972 wrote to memory of 3128 3972 cmd.exe PxxoServicesTrialNet1.exe PID 3972 wrote to memory of 3128 3972 cmd.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 3128 wrote to memory of 3340 3128 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
C:\Users\Admin\D8D1mbf71F58n877GaUN8859f3063p51Xs9a9e0U5ZX1o12r9MD5
d2c08b03c44b14ea8d9ef7827f218d57
SHA1cbffc35201b1da903a9dc06a9c977b94a929f1ef
SHA256c266f81e9d50d44dd7e1919ea64680e748f8ea7a41ba22ac3fa2f41a387cd6c0
SHA5125e033f8ea03cffc66785919989923918b0f9ac57411c568c2d1929bb8c65bf40b63f0bdc8f875dc32131a04dbe89ae92777ec624446b2ed94f372895255f73ff
-
memory/2780-121-0x0000000000413FA4-mapping.dmp
-
memory/2780-120-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2780-124-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3128-135-0x0000000004D20000-0x000000000521E000-memory.dmpFilesize
5.0MB
-
memory/3128-126-0x0000000000000000-mapping.dmp
-
memory/3152-114-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/3152-119-0x00000000021A0000-0x00000000021C7000-memory.dmpFilesize
156KB
-
memory/3152-117-0x00000000048B0000-0x00000000048B1000-memory.dmpFilesize
4KB
-
memory/3152-118-0x00000000047B0000-0x0000000004CAE000-memory.dmpFilesize
5.0MB
-
memory/3152-116-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/3340-139-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3340-137-0x0000000000413FA4-mapping.dmp
-
memory/3516-122-0x0000000000000000-mapping.dmp
-
memory/3972-125-0x0000000000000000-mapping.dmp