Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-04-2021 05:50
Static task
static1
Behavioral task
behavioral1
Sample
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
Resource
win10v20210410
General
-
Target
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
-
Size
186KB
-
MD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
-
SHA1
b0f907aa92d5b35b5b5fcad992f504525d04a87f
-
SHA256
5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
-
SHA512
1762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 280 PxxoServicesTrialNet1.exe 1288 PxxoServicesTrialNet1.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1868 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\ EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exePxxoServicesTrialNet1.exedescription pid process target process PID 1832 set thread context of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 280 set thread context of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exedescription pid process Token: SeDebugPrivilege 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 1288 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exeEXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exeWScript.execmd.exePxxoServicesTrialNet1.exedescription pid process target process PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1832 wrote to memory of 1640 1832 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1640 wrote to memory of 276 1640 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 1640 wrote to memory of 276 1640 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 1640 wrote to memory of 276 1640 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 1640 wrote to memory of 276 1640 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 276 wrote to memory of 1868 276 WScript.exe cmd.exe PID 276 wrote to memory of 1868 276 WScript.exe cmd.exe PID 276 wrote to memory of 1868 276 WScript.exe cmd.exe PID 276 wrote to memory of 1868 276 WScript.exe cmd.exe PID 1868 wrote to memory of 280 1868 cmd.exe PxxoServicesTrialNet1.exe PID 1868 wrote to memory of 280 1868 cmd.exe PxxoServicesTrialNet1.exe PID 1868 wrote to memory of 280 1868 cmd.exe PxxoServicesTrialNet1.exe PID 1868 wrote to memory of 280 1868 cmd.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 280 wrote to memory of 1288 280 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
C:\Users\Admin\D8D1mbf71F58n877GaUN8859f3063p51Xs9a9e0U5ZX1o12r9MD5
d2c08b03c44b14ea8d9ef7827f218d57
SHA1cbffc35201b1da903a9dc06a9c977b94a929f1ef
SHA256c266f81e9d50d44dd7e1919ea64680e748f8ea7a41ba22ac3fa2f41a387cd6c0
SHA5125e033f8ea03cffc66785919989923918b0f9ac57411c568c2d1929bb8c65bf40b63f0bdc8f875dc32131a04dbe89ae92777ec624446b2ed94f372895255f73ff
-
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
memory/276-66-0x0000000000000000-mapping.dmp
-
memory/280-79-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/280-73-0x0000000000000000-mapping.dmp
-
memory/280-75-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1288-84-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1288-81-0x0000000000413FA4-mapping.dmp
-
memory/1640-65-0x0000000074D91000-0x0000000074D93000-memory.dmpFilesize
8KB
-
memory/1640-69-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1640-64-0x0000000000413FA4-mapping.dmp
-
memory/1640-63-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1832-62-0x00000000005A0000-0x00000000005C7000-memory.dmpFilesize
156KB
-
memory/1832-59-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/1832-61-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/1868-70-0x0000000000000000-mapping.dmp