Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-04-2021 05:50
Static task
static1
Behavioral task
behavioral1
Sample
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
Resource
win10v20210410
General
-
Target
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe
-
Size
186KB
-
MD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
-
SHA1
b0f907aa92d5b35b5b5fcad992f504525d04a87f
-
SHA256
5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
-
SHA512
1762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 2344 PxxoServicesTrialNet1.exe 1560 PxxoServicesTrialNet1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exePxxoServicesTrialNet1.exedescription pid process target process PID 3944 set thread context of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 2344 set thread context of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exedescription pid process Token: SeDebugPrivilege 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 1560 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exeEXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exeWScript.execmd.exePxxoServicesTrialNet1.exedescription pid process target process PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 3944 wrote to memory of 1656 3944 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe PID 1656 wrote to memory of 660 1656 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 1656 wrote to memory of 660 1656 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 1656 wrote to memory of 660 1656 EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe WScript.exe PID 660 wrote to memory of 3872 660 WScript.exe cmd.exe PID 660 wrote to memory of 3872 660 WScript.exe cmd.exe PID 660 wrote to memory of 3872 660 WScript.exe cmd.exe PID 3872 wrote to memory of 2344 3872 cmd.exe PxxoServicesTrialNet1.exe PID 3872 wrote to memory of 2344 3872 cmd.exe PxxoServicesTrialNet1.exe PID 3872 wrote to memory of 2344 3872 cmd.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2344 wrote to memory of 1560 2344 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTO_SERFINANZA_475481343360613456378_796289261659419553089_063500257046876715902044919_21933789983685164831902122_p.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
57b6e8cbb49f9e7cfed5bb1e5d2c78d7
SHA1b0f907aa92d5b35b5b5fcad992f504525d04a87f
SHA2565599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
SHA5121762d9f5f83692c87c4489899b2e6c5140ba16ca9444041a01381982f70697ea720342cc605a106e30f386edc884223e4a8ba353aeb7d8a6c4f3b2d29b065305
-
C:\Users\Admin\D8D1mbf71F58n877GaUN8859f3063p51Xs9a9e0U5ZX1o12r9MD5
d2c08b03c44b14ea8d9ef7827f218d57
SHA1cbffc35201b1da903a9dc06a9c977b94a929f1ef
SHA256c266f81e9d50d44dd7e1919ea64680e748f8ea7a41ba22ac3fa2f41a387cd6c0
SHA5125e033f8ea03cffc66785919989923918b0f9ac57411c568c2d1929bb8c65bf40b63f0bdc8f875dc32131a04dbe89ae92777ec624446b2ed94f372895255f73ff
-
memory/660-122-0x0000000000000000-mapping.dmp
-
memory/1560-139-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1560-137-0x0000000000413FA4-mapping.dmp
-
memory/1656-121-0x0000000000413FA4-mapping.dmp
-
memory/1656-120-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1656-124-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2344-135-0x0000000004F70000-0x000000000546E000-memory.dmpFilesize
5.0MB
-
memory/2344-126-0x0000000000000000-mapping.dmp
-
memory/3872-125-0x0000000000000000-mapping.dmp
-
memory/3944-116-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/3944-118-0x0000000004D10000-0x000000000520E000-memory.dmpFilesize
5.0MB
-
memory/3944-119-0x0000000005D10000-0x0000000005D37000-memory.dmpFilesize
156KB
-
memory/3944-114-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/3944-117-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB