Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
02-05-2021 10:36
Static task
static1
Behavioral task
behavioral1
Sample
doc_07621DERG7011220213300.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
doc_07621DERG7011220213300.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
doc_07621DERG7011220213300.exe
-
Size
1.1MB
-
MD5
3295f12e797cd867575617f57c091b42
-
SHA1
e399c5bc013640afc56f21e19f45e971696f92f2
-
SHA256
210d63272f04545a7b964c5712b0157a9e9801500e063a15ecee4b2de2c87254
-
SHA512
a6e85e0f6095e00fd37af065c47892e025b59a0c63c62b3d33802565d5b2ca8c50caf0268a7fdd36b69847ecef2ae4e6a0e0310528b0de0fbad9cc6609831c8b
Score
10/10
Malware Config
Extracted
Family
remcos
C2
www.swqrn.com:16108
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
doc_07621DERG7011220213300.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aivjxn = "C:\\Users\\Public\\Libraries\\nxjviA.url" doc_07621DERG7011220213300.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
doc_07621DERG7011220213300.exedescription ioc process File opened (read-only) \??\X: doc_07621DERG7011220213300.exe File opened (read-only) \??\Z: doc_07621DERG7011220213300.exe File opened (read-only) \??\A: doc_07621DERG7011220213300.exe File opened (read-only) \??\H: doc_07621DERG7011220213300.exe File opened (read-only) \??\V: doc_07621DERG7011220213300.exe File opened (read-only) \??\R: doc_07621DERG7011220213300.exe File opened (read-only) \??\U: doc_07621DERG7011220213300.exe File opened (read-only) \??\E: doc_07621DERG7011220213300.exe File opened (read-only) \??\L: doc_07621DERG7011220213300.exe File opened (read-only) \??\O: doc_07621DERG7011220213300.exe File opened (read-only) \??\J: doc_07621DERG7011220213300.exe File opened (read-only) \??\M: doc_07621DERG7011220213300.exe File opened (read-only) \??\Q: doc_07621DERG7011220213300.exe File opened (read-only) \??\S: doc_07621DERG7011220213300.exe File opened (read-only) \??\T: doc_07621DERG7011220213300.exe File opened (read-only) \??\B: doc_07621DERG7011220213300.exe File opened (read-only) \??\G: doc_07621DERG7011220213300.exe File opened (read-only) \??\I: doc_07621DERG7011220213300.exe File opened (read-only) \??\Y: doc_07621DERG7011220213300.exe File opened (read-only) \??\P: doc_07621DERG7011220213300.exe File opened (read-only) \??\W: doc_07621DERG7011220213300.exe File opened (read-only) \??\F: doc_07621DERG7011220213300.exe File opened (read-only) \??\K: doc_07621DERG7011220213300.exe File opened (read-only) \??\N: doc_07621DERG7011220213300.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
doc_07621DERG7011220213300.exedescription pid process target process PID 1084 set thread context of 968 1084 doc_07621DERG7011220213300.exe doc_07621DERG7011220213300.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
doc_07621DERG7011220213300.exepid process 968 doc_07621DERG7011220213300.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
doc_07621DERG7011220213300.exedescription pid process target process PID 1084 wrote to memory of 968 1084 doc_07621DERG7011220213300.exe doc_07621DERG7011220213300.exe PID 1084 wrote to memory of 968 1084 doc_07621DERG7011220213300.exe doc_07621DERG7011220213300.exe PID 1084 wrote to memory of 968 1084 doc_07621DERG7011220213300.exe doc_07621DERG7011220213300.exe PID 1084 wrote to memory of 968 1084 doc_07621DERG7011220213300.exe doc_07621DERG7011220213300.exe PID 1084 wrote to memory of 968 1084 doc_07621DERG7011220213300.exe doc_07621DERG7011220213300.exe PID 1084 wrote to memory of 968 1084 doc_07621DERG7011220213300.exe doc_07621DERG7011220213300.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc_07621DERG7011220213300.exe"C:\Users\Admin\AppData\Local\Temp\doc_07621DERG7011220213300.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc_07621DERG7011220213300.exeC:\Users\Admin\AppData\Local\Temp\doc_07621DERG7011220213300.exe2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-61-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/968-62-0x000000000042F08F-mapping.dmp
-
memory/968-64-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1084-59-0x00000000752F1000-0x00000000752F3000-memory.dmpFilesize
8KB
-
memory/1084-60-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB