Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-04-2021 03:16
Static task
static1
Behavioral task
behavioral1
Sample
EXTRACTOSERFINANZA149952705997730013733597462.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
EXTRACTOSERFINANZA149952705997730013733597462.exe
Resource
win10v20210408
General
-
Target
EXTRACTOSERFINANZA149952705997730013733597462.exe
-
Size
175KB
-
MD5
7949066c49b82ebce27756a69ee28fee
-
SHA1
20fee757b2258d7a7ed27f1c147753082dbc8548
-
SHA256
dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
-
SHA512
9ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
PxxoServicesTrialNet1.exePxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 840 PxxoServicesTrialNet1.exe 748 PxxoServicesTrialNet1.exe 464 PxxoServicesTrialNet1.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 792 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
EXTRACTOSERFINANZA149952705997730013733597462.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ EXTRACTOSERFINANZA149952705997730013733597462.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" EXTRACTOSERFINANZA149952705997730013733597462.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
EXTRACTOSERFINANZA149952705997730013733597462.exePxxoServicesTrialNet1.exedescription pid process target process PID 1616 set thread context of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 840 set thread context of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 840 PxxoServicesTrialNet1.exe 840 PxxoServicesTrialNet1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
EXTRACTOSERFINANZA149952705997730013733597462.exePxxoServicesTrialNet1.exedescription pid process Token: SeDebugPrivilege 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe Token: SeDebugPrivilege 840 PxxoServicesTrialNet1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 464 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
EXTRACTOSERFINANZA149952705997730013733597462.exeEXTRACTOSERFINANZA149952705997730013733597462.exeWScript.execmd.exePxxoServicesTrialNet1.exedescription pid process target process PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1616 wrote to memory of 1688 1616 EXTRACTOSERFINANZA149952705997730013733597462.exe EXTRACTOSERFINANZA149952705997730013733597462.exe PID 1688 wrote to memory of 1788 1688 EXTRACTOSERFINANZA149952705997730013733597462.exe WScript.exe PID 1688 wrote to memory of 1788 1688 EXTRACTOSERFINANZA149952705997730013733597462.exe WScript.exe PID 1688 wrote to memory of 1788 1688 EXTRACTOSERFINANZA149952705997730013733597462.exe WScript.exe PID 1688 wrote to memory of 1788 1688 EXTRACTOSERFINANZA149952705997730013733597462.exe WScript.exe PID 1788 wrote to memory of 792 1788 WScript.exe cmd.exe PID 1788 wrote to memory of 792 1788 WScript.exe cmd.exe PID 1788 wrote to memory of 792 1788 WScript.exe cmd.exe PID 1788 wrote to memory of 792 1788 WScript.exe cmd.exe PID 792 wrote to memory of 840 792 cmd.exe PxxoServicesTrialNet1.exe PID 792 wrote to memory of 840 792 cmd.exe PxxoServicesTrialNet1.exe PID 792 wrote to memory of 840 792 cmd.exe PxxoServicesTrialNet1.exe PID 792 wrote to memory of 840 792 cmd.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 748 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 748 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 748 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 748 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 840 wrote to memory of 464 840 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA149952705997730013733597462.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA149952705997730013733597462.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA149952705997730013733597462.exe"C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA149952705997730013733597462.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\8B4AfWf1OubMD5
12cd7d6a182fe1d255219bfc2442ef5e
SHA10cacc2650c8b23914942f0afd240f0c20609d2d5
SHA256718938ba08f5b63b2328627ff7a6999ac8062556bdcf7a1ed8ec369991a6a594
SHA5126a4deec2a8ffb9426c45426dd785f83b15a250139193f2fd424c3b62c605de508d2fc5574f4e6175011457d76bfc54079e9af18ce930bfec413ff1a7deead8f6
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
7949066c49b82ebce27756a69ee28fee
SHA120fee757b2258d7a7ed27f1c147753082dbc8548
SHA256dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
SHA5129ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
7949066c49b82ebce27756a69ee28fee
SHA120fee757b2258d7a7ed27f1c147753082dbc8548
SHA256dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
SHA5129ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
7949066c49b82ebce27756a69ee28fee
SHA120fee757b2258d7a7ed27f1c147753082dbc8548
SHA256dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
SHA5129ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
7949066c49b82ebce27756a69ee28fee
SHA120fee757b2258d7a7ed27f1c147753082dbc8548
SHA256dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
SHA5129ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
-
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
7949066c49b82ebce27756a69ee28fee
SHA120fee757b2258d7a7ed27f1c147753082dbc8548
SHA256dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490
SHA5129ca2c9786e2597fa6b318fa6bd28a6a88af251956d80aeb0c039022e70a07a6f9fd4da568daab3c042d1caad6248c80a315b09595aa9ef1102367eb4f23a41d0
-
memory/464-87-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/464-84-0x0000000000413FA4-mapping.dmp
-
memory/792-72-0x0000000000000000-mapping.dmp
-
memory/840-81-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/840-77-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/840-75-0x0000000000000000-mapping.dmp
-
memory/1616-63-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/1616-60-0x0000000001230000-0x0000000001231000-memory.dmpFilesize
4KB
-
memory/1616-62-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/1616-64-0x00000000003A0000-0x00000000003C7000-memory.dmpFilesize
156KB
-
memory/1688-71-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1688-66-0x0000000000413FA4-mapping.dmp
-
memory/1688-65-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1788-68-0x0000000000000000-mapping.dmp