Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 13:03
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe
Resource
win10v20210410
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe
-
Size
1.7MB
-
MD5
99e166082b19603ff6c4cbebd2641813
-
SHA1
407f1729ca0abe94a3202789522807683dfe57aa
-
SHA256
52b98cca3167f7f97a7ae7729aeddee0b2280a18841d692697bd6dea415f3abe
-
SHA512
77a55185038a2070b0b6b72248ec199afa3fc0f2c4b5f649fe46db3647683d6ced86b3071c88719c07a77cb269fb1ffdc72fc7ac37cdcaa472c249a3fb5d7b0f
Malware Config
Extracted
remcos
hjduiebcvzcalpmjdbcnwqadhsiybcnzxswedgap.ydns.eu:2024
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
win.exewin.exepid process 1316 win.exe 1004 win.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1256 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exewin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\"" SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ win.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\"" win.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exewin.exepid process 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1316 win.exe 1316 win.exe 1316 win.exe 1316 win.exe 1316 win.exe 1316 win.exe 1316 win.exe 1316 win.exe 1316 win.exe 1316 win.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exewin.exedescription pid process target process PID 1360 set thread context of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1316 set thread context of 1004 1316 win.exe win.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1624 1360 WerFault.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1784 timeout.exe 856 timeout.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exeWerFault.exewin.exepid process 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 1316 win.exe 1316 win.exe 1316 win.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1624 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exeWerFault.exewin.exedescription pid process Token: SeDebugPrivilege 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe Token: SeDebugPrivilege 1624 WerFault.exe Token: SeDebugPrivilege 1316 win.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
win.exepid process 1004 win.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.execmd.exeSecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exeWScript.execmd.exewin.execmd.exedescription pid process target process PID 1360 wrote to memory of 1876 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe cmd.exe PID 1360 wrote to memory of 1876 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe cmd.exe PID 1360 wrote to memory of 1876 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe cmd.exe PID 1360 wrote to memory of 1876 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe cmd.exe PID 1876 wrote to memory of 1784 1876 cmd.exe timeout.exe PID 1876 wrote to memory of 1784 1876 cmd.exe timeout.exe PID 1876 wrote to memory of 1784 1876 cmd.exe timeout.exe PID 1876 wrote to memory of 1784 1876 cmd.exe timeout.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1280 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe PID 1360 wrote to memory of 1624 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe WerFault.exe PID 1360 wrote to memory of 1624 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe WerFault.exe PID 1360 wrote to memory of 1624 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe WerFault.exe PID 1360 wrote to memory of 1624 1360 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe WerFault.exe PID 1280 wrote to memory of 316 1280 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe WScript.exe PID 1280 wrote to memory of 316 1280 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe WScript.exe PID 1280 wrote to memory of 316 1280 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe WScript.exe PID 1280 wrote to memory of 316 1280 SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe WScript.exe PID 316 wrote to memory of 1256 316 WScript.exe cmd.exe PID 316 wrote to memory of 1256 316 WScript.exe cmd.exe PID 316 wrote to memory of 1256 316 WScript.exe cmd.exe PID 316 wrote to memory of 1256 316 WScript.exe cmd.exe PID 1256 wrote to memory of 1316 1256 cmd.exe win.exe PID 1256 wrote to memory of 1316 1256 cmd.exe win.exe PID 1256 wrote to memory of 1316 1256 cmd.exe win.exe PID 1256 wrote to memory of 1316 1256 cmd.exe win.exe PID 1316 wrote to memory of 1672 1316 win.exe cmd.exe PID 1316 wrote to memory of 1672 1316 win.exe cmd.exe PID 1316 wrote to memory of 1672 1316 win.exe cmd.exe PID 1316 wrote to memory of 1672 1316 win.exe cmd.exe PID 1672 wrote to memory of 856 1672 cmd.exe timeout.exe PID 1672 wrote to memory of 856 1672 cmd.exe timeout.exe PID 1672 wrote to memory of 856 1672 cmd.exe timeout.exe PID 1672 wrote to memory of 856 1672 cmd.exe timeout.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe PID 1316 wrote to memory of 1004 1316 win.exe win.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.703.21955.2754.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\win.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\win.exeC:\Users\Admin\AppData\Roaming\win.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 9282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
4a74e626596d6e66b4bbc59ee6848f2d
SHA1047849ac8735ecc0943428c7cd5e00b52eee06ed
SHA25698bd6dc219a7a3e04d3d67bbec9f0b4d4640831a3a6be0a0078b050041088b0e
SHA5121cd943482d0f1ce2ffaf6ee4a82895e4d57c52051bb14bbda0548cf072b4c5cbe719d2cdb549b5ae7c0241dd9c68dd9d1674acd26aed684b8145500079cc5403
-
C:\Users\Admin\AppData\Roaming\win.exeMD5
99e166082b19603ff6c4cbebd2641813
SHA1407f1729ca0abe94a3202789522807683dfe57aa
SHA25652b98cca3167f7f97a7ae7729aeddee0b2280a18841d692697bd6dea415f3abe
SHA51277a55185038a2070b0b6b72248ec199afa3fc0f2c4b5f649fe46db3647683d6ced86b3071c88719c07a77cb269fb1ffdc72fc7ac37cdcaa472c249a3fb5d7b0f
-
C:\Users\Admin\AppData\Roaming\win.exeMD5
99e166082b19603ff6c4cbebd2641813
SHA1407f1729ca0abe94a3202789522807683dfe57aa
SHA25652b98cca3167f7f97a7ae7729aeddee0b2280a18841d692697bd6dea415f3abe
SHA51277a55185038a2070b0b6b72248ec199afa3fc0f2c4b5f649fe46db3647683d6ced86b3071c88719c07a77cb269fb1ffdc72fc7ac37cdcaa472c249a3fb5d7b0f
-
C:\Users\Admin\AppData\Roaming\win.exeMD5
99e166082b19603ff6c4cbebd2641813
SHA1407f1729ca0abe94a3202789522807683dfe57aa
SHA25652b98cca3167f7f97a7ae7729aeddee0b2280a18841d692697bd6dea415f3abe
SHA51277a55185038a2070b0b6b72248ec199afa3fc0f2c4b5f649fe46db3647683d6ced86b3071c88719c07a77cb269fb1ffdc72fc7ac37cdcaa472c249a3fb5d7b0f
-
\Users\Admin\AppData\Roaming\win.exeMD5
99e166082b19603ff6c4cbebd2641813
SHA1407f1729ca0abe94a3202789522807683dfe57aa
SHA25652b98cca3167f7f97a7ae7729aeddee0b2280a18841d692697bd6dea415f3abe
SHA51277a55185038a2070b0b6b72248ec199afa3fc0f2c4b5f649fe46db3647683d6ced86b3071c88719c07a77cb269fb1ffdc72fc7ac37cdcaa472c249a3fb5d7b0f
-
memory/316-70-0x0000000000000000-mapping.dmp
-
memory/856-84-0x0000000000000000-mapping.dmp
-
memory/1004-87-0x0000000000413FA4-mapping.dmp
-
memory/1004-90-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1256-75-0x0000000000000000-mapping.dmp
-
memory/1280-68-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1280-67-0x0000000000413FA4-mapping.dmp
-
memory/1280-66-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1280-73-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1316-80-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1316-78-0x0000000000000000-mapping.dmp
-
memory/1316-85-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/1360-60-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/1360-63-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/1360-62-0x0000000000270000-0x00000000002AE000-memory.dmpFilesize
248KB
-
memory/1624-74-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1624-69-0x0000000000000000-mapping.dmp
-
memory/1672-83-0x0000000000000000-mapping.dmp
-
memory/1784-65-0x0000000000000000-mapping.dmp
-
memory/1876-64-0x0000000000000000-mapping.dmp