Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-04-2021 07:04
Static task
static1
Behavioral task
behavioral1
Sample
hsCNXH5WfPktCMH.exe
Resource
win7v20210410
General
-
Target
hsCNXH5WfPktCMH.exe
-
Size
1.1MB
-
MD5
e5a2da8ed26dafdba1593c27e93fe424
-
SHA1
9b365ea6cc2a88b2a32d56f4a079ea3fa7a1a6b9
-
SHA256
d65a05ac95914160ce98904bf3f203f99d8261dbda038d2309419d345f78e2d8
-
SHA512
79e7cd6dd43674c7e6a187e7aa4c895b149b4aefc445b18457956a7edde66ba6981e18933c63331786445d36e221f14da5dcab0602b40bed6b9940110adc8d1d
Malware Config
Extracted
remcos
217.138.212.58:52667
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
hsCNXH5WfPktCMH.exedescription pid process target process PID 4804 set thread context of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
hsCNXH5WfPktCMH.exepowershell.exepowershell.exepowershell.exepid process 4804 hsCNXH5WfPktCMH.exe 4804 hsCNXH5WfPktCMH.exe 4804 hsCNXH5WfPktCMH.exe 4804 hsCNXH5WfPktCMH.exe 2520 powershell.exe 1512 powershell.exe 1080 powershell.exe 2520 powershell.exe 1512 powershell.exe 1080 powershell.exe 1080 powershell.exe 1512 powershell.exe 2520 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
hsCNXH5WfPktCMH.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4804 hsCNXH5WfPktCMH.exe Token: SeDebugPrivilege 1080 powershell.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 2520 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
hsCNXH5WfPktCMH.exepid process 2576 hsCNXH5WfPktCMH.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
hsCNXH5WfPktCMH.exehsCNXH5WfPktCMH.execmd.exedescription pid process target process PID 4804 wrote to memory of 1080 4804 hsCNXH5WfPktCMH.exe powershell.exe PID 4804 wrote to memory of 1080 4804 hsCNXH5WfPktCMH.exe powershell.exe PID 4804 wrote to memory of 1080 4804 hsCNXH5WfPktCMH.exe powershell.exe PID 4804 wrote to memory of 1512 4804 hsCNXH5WfPktCMH.exe powershell.exe PID 4804 wrote to memory of 1512 4804 hsCNXH5WfPktCMH.exe powershell.exe PID 4804 wrote to memory of 1512 4804 hsCNXH5WfPktCMH.exe powershell.exe PID 4804 wrote to memory of 1796 4804 hsCNXH5WfPktCMH.exe schtasks.exe PID 4804 wrote to memory of 1796 4804 hsCNXH5WfPktCMH.exe schtasks.exe PID 4804 wrote to memory of 1796 4804 hsCNXH5WfPktCMH.exe schtasks.exe PID 4804 wrote to memory of 2520 4804 hsCNXH5WfPktCMH.exe powershell.exe PID 4804 wrote to memory of 2520 4804 hsCNXH5WfPktCMH.exe powershell.exe PID 4804 wrote to memory of 2520 4804 hsCNXH5WfPktCMH.exe powershell.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 4804 wrote to memory of 2576 4804 hsCNXH5WfPktCMH.exe hsCNXH5WfPktCMH.exe PID 2576 wrote to memory of 3484 2576 hsCNXH5WfPktCMH.exe cmd.exe PID 2576 wrote to memory of 3484 2576 hsCNXH5WfPktCMH.exe cmd.exe PID 2576 wrote to memory of 3484 2576 hsCNXH5WfPktCMH.exe cmd.exe PID 3484 wrote to memory of 4564 3484 cmd.exe reg.exe PID 3484 wrote to memory of 4564 3484 cmd.exe reg.exe PID 3484 wrote to memory of 4564 3484 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hsCNXH5WfPktCMH.exe"C:\Users\Admin\AppData\Local\Temp\hsCNXH5WfPktCMH.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\hsCNXH5WfPktCMH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NgFXSXBboDHspt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NgFXSXBboDHspt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2CA9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NgFXSXBboDHspt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\hsCNXH5WfPktCMH.exe"C:\Users\Admin\AppData\Local\Temp\hsCNXH5WfPktCMH.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
b9ad74ec5b6bb2828cdb3bb0a0b1d392
SHA1f2d3cd9bd4c683577c363171518f49bc56cb8ce1
SHA2564f42408cf66a5098919484a411cfba779be5699cf7504650c8697a99d7bdb34e
SHA5127d5ec00fc474f3093dbf0e986c718470b0b4bd929ae37bc4cfbedab199cf2a21b9a4145abf7554a877316999879b2053086f4d3bcd658c0f751d314a17af4814
-
C:\Users\Admin\AppData\Local\Temp\tmp2CA9.tmpMD5
3949e85fbde4810959c42aff133d751f
SHA118c6736f55de0cfe6843aa19311107ab4a070df7
SHA2562496c11d14dd3c94c7e6aba7588ff61d057cca271f6cf9f8a045fd3aa768e466
SHA512745207d54dc5fa89ae1aa893caa099aef4f71d26961d914bd87f6e4046816957d628b89355e3833f62a5051d543f5fb5347bc198b7abd1d61c183ee596e6b0ec
-
memory/1080-153-0x0000000007EF0000-0x0000000007EF1000-memory.dmpFilesize
4KB
-
memory/1080-131-0x00000000075F0000-0x00000000075F1000-memory.dmpFilesize
4KB
-
memory/1080-139-0x0000000006FB2000-0x0000000006FB3000-memory.dmpFilesize
4KB
-
memory/1080-194-0x000000007E890000-0x000000007E891000-memory.dmpFilesize
4KB
-
memory/1080-197-0x0000000006FB3000-0x0000000006FB4000-memory.dmpFilesize
4KB
-
memory/1080-137-0x0000000006FB0000-0x0000000006FB1000-memory.dmpFilesize
4KB
-
memory/1080-150-0x0000000007540000-0x0000000007541000-memory.dmpFilesize
4KB
-
memory/1080-125-0x0000000000000000-mapping.dmp
-
memory/1080-128-0x0000000006F30000-0x0000000006F31000-memory.dmpFilesize
4KB
-
memory/1512-156-0x00000000073E0000-0x00000000073E1000-memory.dmpFilesize
4KB
-
memory/1512-129-0x0000000000000000-mapping.dmp
-
memory/1512-199-0x00000000042C3000-0x00000000042C4000-memory.dmpFilesize
4KB
-
memory/1512-140-0x00000000042C0000-0x00000000042C1000-memory.dmpFilesize
4KB
-
memory/1512-142-0x00000000042C2000-0x00000000042C3000-memory.dmpFilesize
4KB
-
memory/1512-195-0x000000007EBF0000-0x000000007EBF1000-memory.dmpFilesize
4KB
-
memory/1796-130-0x0000000000000000-mapping.dmp
-
memory/2520-163-0x0000000004240000-0x0000000004241000-memory.dmpFilesize
4KB
-
memory/2520-160-0x00000000075C0000-0x00000000075C1000-memory.dmpFilesize
4KB
-
memory/2520-138-0x0000000000000000-mapping.dmp
-
memory/2520-165-0x0000000007450000-0x0000000007451000-memory.dmpFilesize
4KB
-
memory/2520-164-0x0000000004242000-0x0000000004243000-memory.dmpFilesize
4KB
-
memory/2520-168-0x0000000007D80000-0x0000000007D81000-memory.dmpFilesize
4KB
-
memory/2520-198-0x0000000004243000-0x0000000004244000-memory.dmpFilesize
4KB
-
memory/2520-196-0x000000007E0E0000-0x000000007E0E1000-memory.dmpFilesize
4KB
-
memory/2520-171-0x0000000007CC0000-0x0000000007CC1000-memory.dmpFilesize
4KB
-
memory/2576-159-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2576-141-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2576-143-0x000000000042EEEF-mapping.dmp
-
memory/3484-146-0x0000000000000000-mapping.dmp
-
memory/4564-149-0x0000000000000000-mapping.dmp
-
memory/4804-114-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/4804-122-0x0000000007910000-0x000000000791D000-memory.dmpFilesize
52KB
-
memory/4804-121-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/4804-120-0x0000000003060000-0x0000000003061000-memory.dmpFilesize
4KB
-
memory/4804-123-0x0000000007240000-0x00000000072ED000-memory.dmpFilesize
692KB
-
memory/4804-119-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/4804-124-0x0000000009EF0000-0x0000000009F68000-memory.dmpFilesize
480KB
-
memory/4804-118-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/4804-117-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/4804-116-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB