Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-04-2021 06:41
Static task
static1
Behavioral task
behavioral1
Sample
Neues Lieferantenformular,pdf.scr
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Neues Lieferantenformular,pdf.scr
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
Neues Lieferantenformular,pdf.scr
-
Size
832KB
-
MD5
3f4f150ed7ab62f3f08315fa85a1e1f0
-
SHA1
24890995fabbfb50230729d5cceb4d5a92199a42
-
SHA256
f0896ba259cc40a67474db857cbca2cd43099f5b49be45c3e3a3a34a06765b7f
-
SHA512
67df52b24d57dc399c2c819d27749e8b54b7494563d075c7305716d57eae1625321ea8083c1964d76721a1ec436e5a0d53403c2c737d895c9068c0632ea78248
Score
10/10
Malware Config
Extracted
Family
remcos
C2
Officialsw.chickenkiller.com:2310
official.ydns.eu:2310
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Neues Lieferantenformular,pdf.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rwdfnm = "C:\\Users\\Admin\\AppData\\Local\\mnfdwR.url" Neues Lieferantenformular,pdf.scr -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Neues Lieferantenformular,pdf.scrdescription pid process target process PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe PID 1652 wrote to memory of 1840 1652 Neues Lieferantenformular,pdf.scr DpiScaling.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Neues Lieferantenformular,pdf.scr"C:\Users\Admin\AppData\Local\Temp\Neues Lieferantenformular,pdf.scr" /S1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1652-59-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/1652-60-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1652-62-0x00000000004E0000-0x00000000004FA000-memory.dmpFilesize
104KB
-
memory/1840-65-0x0000000000000000-mapping.dmp
-
memory/1840-67-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1840-69-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1840-70-0x0000000010590000-0x000000001060B000-memory.dmpFilesize
492KB
-
memory/1840-71-0x0000000000500000-0x0000000000578000-memory.dmpFilesize
480KB
-
memory/1840-72-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB